Easy!Appointments is a self‑hosted scheduler where each provider has a separate appointment calendar. The vulnerability appears in the appointments/store and appointments/update endpoints, which do not verify that the supplied id_users_provider belongs to the authenticated provider. Consequently, a provider can inject appointments into another provider’s schedule or reassign existing appointments to a different provider. The store endpoint also contains a write‑before‑crash flaw, meaning that a request that ultimately fails can still persist an unauthorized appointment before the application crashes, creating a false sense of success for the attacker. This flaw enables the alteration of scheduling data, potentially disrupting client appointments.

The affected vendor is alextselegidis; the product is the Easy!Appointments application. All releases older than version 1.6.0 are vulnerable. The patch was released1.6.0 update, which added provider‑level validation to the store and update endpoints and removed the write‑before‑crash condition. No other versions or components are listed as affected.

The CVSS score of 3.3 indicates low overall severity, and the EPSS score of less than 1% suggests that exploitation is unlikely at present. The flaw is not in CISA’s KEV catalog. Exploitation requires a valid provider account; only authenticated providers can exercise the vulnerable endpoints. Based on the description, the likely attack vector is an authenticated provider using the store or update endpoint. The attack surface is thus limited to authenticated users, but the impact on integrity of scheduling is non‑trivial, as unauthorized appointments can be created or moved between calendars, causing scheduling mishaps. The write‑before‑crash bug also means that even failed requests can leave unauthorized data in the database, further compounding the integrity risk.