← CVE Intelligence

CVE-2026-23622

CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover PUBLISHED

Description (CNA)

Easy!Appointments is a self hosted appointment scheduler. In 1.5.2 and earlier, application/core/EA_Security.php::csrf_verify() only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), so an attacker can perform CSRF by forcing a victim's browser to issue a crafted GET request. Impact: creation of admin accounts, modification of admin email/password, and full admin account takeover.

Affected (CNA)

Vendor / productVersions
alextselegidis / easyappointmentsaffected <= 1.5.2

CWE

CWE-352

References

ADP enrichment

CISA-ADP

No English description supplied.