CVE-2026-108758

{
  "etk_id": "ETK-2026-1257",
  "cve_id": "CVE-2026-108758",
  "display_id": "CVE-2026-108758",
  "ghsa_id": "GHSA-q8ph-7hq3-m5wq",
  "euvd_id": "EUVD-2026-96923",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in Easy!Appointments booking registration",
  "summary": "Easy!Appointments versions through 1.6.0 are affected by an authorization check failure in booking registration. An unauthenticated remote party may alter appointment records and gain control over their subsequent management when the registration endpoint is reachable.",
  "mitigation": "Restrict unauthenticated access to the booking registration endpoint, such as by placing it behind an access-control layer until a vendor update is available. Monitor appointment changes for unauthorized modifications and management-token changes.",
  "vendor": "alextselegidis",
  "product": "easyappointments",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.6.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "easyappointments",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
  "epss_score": 0.0026,
  "epss_percentile": 0.1692,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 28.67926285,
  "t0_at": "2026-10-11T12:19:55.847000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-11T12:19:55.847000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-11T12:19:55.847000+00:00",
      "url": "https://github.com/advisories/GHSA-q8ph-7hq3-m5wq"
    }
  }
}