CVE-2026-108758

Easy!Appointments versions through 1.6.0 are vulnerable to an authorization bypass within the Booking::register() function. This flaw allows unauthenticated attackers to modify any appointment by providing an appointment ID without the required hash. By enumerating sequential IDs and self-asserti...

EUVD-2026-96923

Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted managemode...