EUVD-2026-43720
GHSA-w8xc-8g92-v77h
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Any normal provider account can exploit this with a simple parameter substitution (AC:L, PR:L); impact is integrity-only - no confidentiality or availability loss described.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the appointments/search response, proving that provider isolation is an intended security boundary. However, the direct mutation endpoints appointments/store and appointments/update only check generic appointment privileges and never verify that the submitted id_users_provider belongs to the current session. A normal authenticated provider can inject new appointments into another provider's schedule via store, or reassign existing appointments into a foreign provider's calendar via update. The store path contains an additional write-before-crash bug: the unauthorized row is committed to the database before the controller crashes on a type error, so the attacker receives an error response while the foreign appointment is already persisted. Version 1.6.0 patches the issue.
AnalysisAI
Horizontal privilege escalation in Easy!Appointments prior to 1.6.0 permits any authenticated provider to inject appointments into a peer provider's calendar or reassign existing appointments across provider boundaries by supplying an arbitrary id_users_provider value to the store and update API endpoints. The asymmetry is stark: the search endpoint correctly enforces provider-scoped filtering, confirming the isolation boundary was intentionally designed - making this an incomplete implementation rather than a missing feature. An additional write-before-crash defect on the store path means the unauthorized database row is silently persisted even when the attacker receives an HTTP error response. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Technical ContextAI
CWE-639 (Authorization Bypass Through User-Controlled Key) is the root cause: the application exposes the internal relational key id_users_provider directly in user-controlled API request bodies for appointments/store and appointments/update, then validates only generic appointment-write privileges without confirming the submitted key is owned by the authenticated session. This is a textbook Insecure Direct Object Reference (IDOR) applied to a horizontal privilege boundary between peer provider accounts. CPE cpe:2.3:a:alextselegidis:easyappointments:*:*:*:*:*:*:*:* covers all pre-1.6.0 releases. The write-before-crash defect arises because the CodeIgniter-based controller layer commits the ORM row to the database before a downstream type error terminates execution, producing a persisted unauthorized record with no successful HTTP response to the caller - a particularly dangerous combination for detection.
RemediationAI
Upgrade to Easy!Appointments version 1.6.0, which patches the provider authorization bypass per the vendor security advisory at https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-w8xc-8g92-v77h; the fix is tracked in commit 4abb10545d83ac1a57d03f6502376ee67696ee7c. If an immediate upgrade is not feasible, restrict provider account registration to fully trusted internal personnel, as exploitation requires a valid provider-role credential - removing untrusted provider accounts eliminates the attack surface entirely. As a detection compensating control, query the database directly for appointments where the id_users_provider value does not match the account that submitted the booking, rather than relying on HTTP error logs, since the write-before-crash defect means unauthorized rows persist despite error responses. WAF rules blocking id_users_provider parameter substitution on the store and update endpoints are possible but require session-aware logic tied to the application's provider ID mapping, which is complex to implement correctly without application-layer access.
More in Easyappointments
View allAn issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php f
Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated critical severi
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments p
Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated high severity (CVSS 8.8), th
API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated high severity (CVSS
alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by paramet
Cross-Site Request Forgery (CSRF) in Easy!Appointments 1.5.2 and earlier allows remote attackers to perform administrati
Cross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute arbit
Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated medium severity (CVSS
Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated medium se
Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash). Rated
Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated medium se
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today