AI Tool Identifies BOLA Vulnerabilities in Easy!Appointments
Unit 42's AI-powered tool found 15 BOLA vulnerabilities in Easy!Appointments, rated up to CVSS 9.9, letting low-privileged users escalate privileges; fixed in 1.5.0.
48
Product
Easy!Appointments
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenAug 17, 2026
- Last mentionedAug 17, 2026
Timeline
2 articles · newest firstHarnessing LLMs for Automating BOLA Detection
Unit 42's BOLABuster methodology uses LLMs to automate detection of broken object-level authorization vulnerabilities, uncovering flaws in Grafana, Harbor, and Easy!Appointments.
45
Related CVEs
by mentions- CVE-2023-3288<1%8.8A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system
- CVE-2023-3287<1%8.8A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system
- CVE-2023-38051<1%8.1A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, modify or delete a low privileged user (secretary)
- CVE-2023-38054<1%8.1A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer)
- CVE-2023-38050<1%8.1A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin)
- CVE-2023-38047<1%8.1A BOLA vulnerability in GET, PUT, DELETE /categories/{categoryId} allows a low privileged user to fetch, modify or delete the category of any user (including…
- CVE-2023-3285<1%7.7A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system (including admin)
- CVE-2023-3289<1%6.5A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin)
- CVE-2024-1313<1%6.5It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to…
- CVE-2023-3290<1%5.0A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system
Appears with
- Unit 42threat actor · 2
- Palo Alto Networksvendor · 2
- Unit 42organization · 2
- Grafanaproduct · 2
- Palo Alto Networksorganization · 2
- Harborproduct · 1
- Easy!Appointmentsvendor · 1
- BOLABusterai model · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.