Is CVE-2026-109524 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109524 being exploited in the wild.

How severe is CVE-2026-109524?

Medium severity, with a CVSS score of 5.3, published 13 October 2026.

Which products and versions are affected?

Girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5.

How is CVE-2026-109524 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-109524?

Check whether you run Girishsaraf Online-Appointment-Booking-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109524: girishsaraf Online-Appointment-Booking-System missing authorization in admin pages

CVE-2026-109524 · Severity: medium · CVSS 5.3 · Published 2026-10-13

Online-Appointment-Booking-System is a web application for managing clinic appointments and doctor schedules. Admin display pages in this system fail to verify user authentication or administrative permissions, allowing unauthenticated attackers to remotely read sensitive data about doctors, clinics, and managers. This could lead to unauthorized disclosure of private healthcare information.

Technologies: Girishsaraf Online-Appointment-Booking-System. Vendors: Girishsaraf.

Quick answers

Is CVE-2026-109524 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109524 being exploited in the wild.
How severe is CVE-2026-109524?: Medium severity, with a CVSS score of 5.3, published 13 October 2026.
Which products and versions are affected?: Girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5.
Is there a fix for CVE-2026-109524?: No fixed version is recorded yet. Add session validation and role-based access control checks (session_start() and $_SESSION verification) to all admin display pages before querying and returning sensitive data. Alternatively, restrict network access to admin pages through web server configuration or firewall rules until patches are available.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-109524 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-109524?: Check whether you run Girishsaraf Online-Appointment-Booking-System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Add session validation and role-based access control checks (session_start() and $_SESSION verification) to all admin display pages before querying and returning sensitive data. Alternatively, restrict network access to admin pages through web server configuration or firewall rules until patches are available.</anigation> </invoke>

Technical details

Multiple admin display pages (showdoctor.php, showclinic.php, showmanager.php, showdoctorschedule.php) lack authentication checks and do not call session_start() or verify $_SESSION variables before querying and echoing database records. An unauthenticated remote attacker can directly access these pages to enumerate and extract sensitive healthcare data. The vulnerability is a missing authorization control at the application layer.

Affected products

girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5

Timeline

2026-09-16: disclosed: Vulnerability reported via GitHub issue #14
2026-10-13: advisory: CVE-2026-109524 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.