CVE-2026-108758 alextselegidis CVE debrief

Who should care

Defenders responsible for Easy!Appointments installations, security teams monitoring for suspicious activity, and administrators of affected systems should be aware of this vulnerability and take necessary actions to prevent exploitation.

Why it matters

CVE-2026-108758 is a high-severity authorization bypass vulnerability in Easy!Appointments that allows unauthenticated attackers to modify appointments, rebind them to attacker-controlled customers, and obtain management hashes. Defenders should prioritize patching affected installations, restricting access to the booking/register endpoint, and monitoring for suspicious activity.

• Unauthenticated attackers can modify appointment details, potentially leading to security breaches.
• Attackers can rebind appointments to attacker-controlled customers, affecting customer data and security.
• Obtaining management hashes can allow attackers to reschedule or cancel appointments, further compromising system integrity.

Technical summary

The vulnerability is caused by a lack of proper authorization in the Booking::register() method, allowing attackers to modify appointments without a valid hash. This issue affects Easy!Appointments through version 1.6.0, enabling unauthenticated attackers to rewrite appointment details, rebind them to attacker-controlled customers, and obtain management hashes for rescheduling or cancellation. The vulnerability has a high CVSS score of 8.8 and is considered a high-severity issue. Defenders should prioritize verifying and patching affected installations, restricting access to the booking/register endpoint, and monitoring for suspicious activity.

Defensive priority

Defenders should prioritize verifying and patching affected Easy!Appointments installations, restricting access to the booking/register endpoint, and monitoring for suspicious appointment modifications.

Recommended defensive actions

• Verify and patch affected Easy!Appointments installations to prevent unauthorized appointment modifications.
• Restrict access to the booking/register endpoint to only trusted users.
• Monitor for suspicious appointment modifications and implement additional security measures as needed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to additional information. Defenders should verify and patch affected Easy!Appointments installations, restrict access to the booking/register endpoint, and monitor for suspicious appointment modifications. Evidence limits suggest focusing on confirmed details and avoiding speculation. The vulnerability allows unauthenticated attackers to modify appointments, rebind them to attacker-controlled customers, or

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.