Easy!Appointments EUVD-2026-96923

No special configuration is required: the Booking::register() endpoint is public and unauthenticated by design (it is the customer-facing booking flow), so default deployments of Easy!Appointments through 1.6.0 are exploitable. The concrete prerequisite is that target appointments already exist, since the attacker supplies an existing appointment id together with a self-asserted manage_mode flag and omits the appointment_hash that the fixed version now mandates. The only practical limiting factors are that appointment IDs are sequential integers (making enumeration trivial rather than a true obstacle) and that the instance must be running version 1.6.0 or earlier; the patched release rejects updates lacking a valid hash. No user interaction, authentication, or non-default setting limits exploitation.

This is a genuine priority, not merely a high-CVSS paper tiger. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no authentication and no user interaction - fully consistent with the description of an unauthenticated IDOR in the public Booking::register() endpoint. The CWE-639 (authorization bypass via user-controlled key) and the vendor's own changelog ('unauthenticated IDOR vulnerability ... arbitrary appointment takeover') corroborate the vector, so the signals are internally consistent rather than conflicting. The vulnerable-system impact is correctly weighted toward integrity (VI:H - attackers rewrite/rebind appointments) with low confidentiality (VC:L - management hashes and appointment details are disclosed) and no availability impact (VA:N). Key exploitation enablers raising real-world risk: appointment IDs are sequential and enumerable, and the manage_mode flag is self-asserted by the client, so exploitation is trivially scriptable and automatable across all existing appointments. Mitigating the urgency: EPSS is NOT provided in the input, and KEV status is absent (not in CISA KEV), so there is no evidence of active mass exploitation yet - the risk is currently assessed from exploitability, not observed attacks. A detailed public technical write-up (hackmd) and VulnCheck advisory exist, lowering the barrier to weaponization even though no packaged exploit flag is set in the input.

An unauthenticated attacker sends crafted requests to the public Easy!Appointments Booking::register() endpoint, iterating through sequential appointment IDs while setting a self-asserted manage_mode flag and omitting the appointment hash. Because the pre-patch code never validated the hash, the attacker rewrites each appointment's details, rebinds it to an attacker-controlled customer, and harvests the returned management hash - enabling arbitrary rescheduling or cancellation. A detailed public technical write-up exists (hackmd), making exploitation straightforward to reproduce, though no packaged exploit tool is confirmed in the input.