API Privilege Escalation in alextselegidis/easyappointments

Vulnerability

The vulnerability is an API privilege escalation in Easy!Appointments, an open-source appointment scheduler. In versions prior to 1.5.0, the API authentication logic in Api.php did not verify that the authenticated user had the admin role slug. The check_login function only validated credentials but did not enforce role checks, allowing any valid user (including non-admin) to access admin-level API endpoints. The fix in commit 63dbb51 adds a check for role_slug to ensure only admin users can authenticate via the API [1][3].

Exploitation

An attacker can exploit this by obtaining valid credentials for any user account (e.g., through brute-force, leaked credentials, or social engineering). With those credentials, the attacker can make API requests to admin endpoints, bypassing the intended role-based access control. No special network position is required beyond normal HTTP access to the application. The attacker simply sends HTTP Basic Auth with the user's credentials to the API, and prior to the fix, the system would authenticate them without checking if they are an admin [3][4].

Impact

Successful exploitation allows an attacker to perform any administrative action via the API, including creating, modifying, or deleting appointments, services, providers, and user accounts. This leads to full system takeover, as the attacker gains complete control over the Easy!Appointments instance [1][4]. The impact is high confidentiality, integrity, and availability compromise.

Mitigation

The vulnerability is fixed in version 1.5.0 of Easy!Appointments. Users should upgrade to 1.5.0 or later immediately. The fix is implemented in commit 63dbb51, which adds role slug verification in the API authentication method [3]. No workarounds are documented; upgrading is the recommended mitigation. The CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.