CVE-2026-105197

{
  "etk_id": "ETK-2026-1449",
  "cve_id": "CVE-2026-105197",
  "display_id": "CVE-2026-105197",
  "ghsa_id": "GHSA-gr76-mf2h-68h2",
  "euvd_id": "EUVD-2026-94769",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Improper record authorization in Appointment Booking Plugin",
  "summary": "Appointment Booking Plugin versions before 5.6.5 can allow staff accounts restricted to specific records to delete orders, customers, or transactions outside their assigned scope. An attacker needs an authenticated backend staff account with a record-scoped role.",
  "mitigation": "Upgrade Appointment Booking Plugin to version 5.6.5 or later. Review backend staff accounts and limit access to trusted users until the update is applied.",
  "vendor": null,
  "product": "Appointment Booking Plugin",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 5.6.5"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "5.6.5"
      ],
      "package_name": "Appointment Booking Plugin",
      "purl": null
    }
  ],
  "cwes": [
    639
  ],
  "cvss_score": 2.7,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
  "epss_score": 0.0017,
  "epss_percentile": 0.0613,
  "epss_asof": "2026-10-26",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.01722571666666667,
  "t0_at": "2026-10-08T06:00:07.266000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-24T13:48:52.855864+00:00",
      "days": 16.325527660462964,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T06:00:07.266000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-08T06:00:07.266000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T06:00:07.266000+00:00",
      "url": "https://github.com/advisories/GHSA-gr76-mf2h-68h2"
    }
  }
}