{"id":"CVE-2023-24058","aliases":["EUVD-2023-28121","GHSA-cfwr-wq2f-j365"],"status":"published","title":"Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other...","description":"Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservation_save.php. NOTE: 2.5.5 is a version from 2014; the latest version of Booked Scheduler is not affected. However, LabArchives Scheduler (Sep 6, 2022 Feature Release) is affected.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01022,"percentile":0.63941,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2023-01-22T00:00:00Z","modified":"2026-06-17T05:38:34Z","products":[{"vendor":"twinkletoessoftware","product":"booked"}],"references":[{"url":"https://s1n1st3r.gitbook.io/theb10g/booked-scheduler-v2.5.5-vulnerability","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.limswiki.org/index.php/Booked","tags":["x_transferred","Third Party Advisory"]},{"url":"https://github.com/LibreBooking/app/tags?after=2.7.1","tags":["x_transferred","Third Party Advisory"]},{"url":"https://github.com/LibreBooking/app/blob/0a6cb1a9eb84835553c8caf93db2791f8655140f/Web/ajax/reservation_save.php","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://github.com/LibreBooking/app/blob/0a6cb1a9eb84835553c8caf93db2791f8655140f/Pages/Ajax/ReservationSavePage.php#L234-L237","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.labarchives.com/labarchives-knowledge-base/2022-feature-releases-2/","tags":["x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://www.bookedscheduler.com/the-future-of-booked/","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24058"},{"url":"https://www.bookedscheduler.com/the-future-of-booked"},{"url":"https://www.labarchives.com/labarchives-knowledge-base/2022-feature-releases-2"},{"url":"https://github.com/advisories/GHSA-cfwr-wq2f-j365"}],"sources":{"cve":[{"id":"CVE-2023-24058","description":"Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservation_save.php. NOTE: 2.5.5 is a version from 2014; the latest version of Booked Scheduler is not affected. However, LabArchives Scheduler (Sep 6, 2022 Feature Release) is affected.","status":"published","published":"2023-01-22T00:00:00Z","modified":"2025-04-02T16:09:24.559Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:35:27.006218Z"}],"euvd":[{"id":"EUVD-2023-28121","description":"Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservation_save.php. NOTE: 2.5.5 is a version from 2014; the latest version of Booked Scheduler is not affected. However, LabArchives Scheduler (Sep 6, 2022 Feature Release) is affected.","status":"published","published":"2023-01-22T00:00:00Z","modified":"2025-04-02T16:09:24Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:44.372321Z"}],"ghsa":[{"id":"GHSA-cfwr-wq2f-j365","title":"Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other...","description":"Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservation_save.php. NOTE: 2.5.5 is a version from 2014.","status":"published","published":"2023-01-22T06:30:27Z","modified":"2025-04-02T18:31:45Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:00:36.145205Z"}],"nvd":[{"id":"CVE-2023-24058","description":"Booked Scheduler 2.5.5 allows authenticated users to create and schedule events for any other user via a modified userId value to reservation_save.php. NOTE: 2.5.5 is a version from 2014; the latest version of Booked Scheduler is not affected. However, LabArchives Scheduler (Sep 6, 2022 Feature Release) is affected.","status":"published","published":"2023-01-22T06:15:10.293Z","modified":"2026-06-17T05:38:34.703Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:07:46.064662Z"}]}}