Authorization Bypass

alextselegidis/easyappointments is vulnerable for Authorization Bypass. The vulnerability is due to insufficient access controls on the GET, PUT, and DELETE methods for /appointments/{appointmentId}, allowing a low-privileged user to fetch, modify, or delete any user’s appointment, including those of administrators. Attackers can exploit this to gain unauthorized access and manipulate data.