https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-28T07:33:52.203753+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-86839 CVE-2026-86839 — Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR 2026-09-28T07:33:52.205553+00:00

Affected: Unknown Online Scheduling and Appointment Booking System

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify and delete other staff members' appointments and payments, including the associated customer's personal information.