Cyber Risks · Unit 42 Palo Alto Networks

AI Tool Identifies BOLA Vulnerabilities in Easy!Appointments

Summary: Unit 42 researchers used a GenAI-based automated BOLA detection tool to test the open-source scheduling application Easy!Appointments in 2023 and found 15 Broken Object-Level Authorization vulnerabilities, tracked as CVE-2023-3285 to CVE-2023-3290 and CVE-2023-38047 to CVE-2023-38055. The flaws let low-privileged logged-in users such as customers and secretaries view and manipulate appointments created by providers and admins, carried CVSS scores from 5 to 9.9 with seven at 9.9, and were patched in version 1.5.0.
Why it matters: Seven of the 15 flaws scored 9.9, and in the documented case a secretary could alter an admin's appointment via API calls the UI never permits, while the appointment hash stayed unchanged and gave the false impression nothing was modified.

Read the original at Unit 42 Palo Alto Networks ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-3285 CVE-2023-3290 CVE-2023-38047 CVE-2023-38055 CVE-2024-1313
Related: Exposing a New BOLA Vulnerability in Grafana Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026