https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T12:34:59.448173+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-11676 EUVD-2026-11676 2026-10-18T12:34:59.450714+00:00 EUVD-2026-11676 https://cve.radiocsirt.org/vuln/fkie_cve-2022-1397 fkie_cve-2022-1397 2026-10-18T12:34:59.450746+00:00

API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Full system takeover.

 https://cve.radiocsirt.org/vuln/ghsa-7f62-4887-cfv5 GHSA-7f62-4887-cfv5 — Privilege escalation in easyappointments 2026-10-18T12:34:59.450775+00:00

Affected: Packagist: alextselegidis/easyappointments

The Easy!Appointments API authorization is checked against the user's existence, without validating the permissions. As a result, a low privileged user (eg. provider) can create a new admin user via the "/api/v1/admins/" endpoint and take over the system. A [patch](https://github.com/alextselegidis/easyappointments/commit/63dbb51decfcc1631c398ecd6d30e3a337845526) is available on the `develop` branch of the repository.

 https://cve.radiocsirt.org/vuln/gsd-2022-1397 gsd-2022-1397 2026-10-18T12:34:59.450802+00:00 gsd-2022-1397