CVE-2026-109525 Details
Description
A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads to missing authorization. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
A missing authorization vulnerability has been identified in the Online Appointment Booking System by Girish Saraf, specifically in the Submit2 handler of the changebookingstatus.php file, prior to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5. The vulnerability allows an unauthenticated user to manipulate booking status updates by sending crafted arrays of usernames, timestamps, and status values. This exploitation can be performed remotely, potentially leading to unauthorized changes in appointment statuses.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/girishsaraf/Online-Appointment-Booking-System/ | [email protected] | ProductVendor |
| https://github.com/girishsaraf/Online-Appointment-Booking-System/issues/15 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-109525 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/984343 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/417189 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/417189/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| girishsaraf Online-Appointment-Booking-System | f427b4757128ca253d33d0cc4e87bbb9c999a4d5 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | New CVE Received | [email protected] |
| Oct 13, 2026 | CVE Modified | CISA-ADP |