Nextcloud Calendar Blind Appointment Booking Vulnerability

A vulnerability in Nextcloud Calendar versions 4.0.0 through 4.7.18, 5.0.0 through 5.5.5, and 6.0.0 through 6.0.0 allows users to book appointments without a valid appointment token, by using a sequential ID. This issue has been addressed in versions 4.7.19, 5.5.6, and 6.0.1.

Impact

Exploitation of this vulnerability allows for unauthorized booking of appointments, potentially leading to scheduling conflicts or misuse of the calendar system.

Reproduction

To reproduce this vulnerability, send a request to book an appointment using a sequential ID while omitting the appointment token. This can be done by accessing the appointment booking endpoint and providing the ID without the corresponding token, which is required for a legitimate booking.

Remediation

Users are advised to update Nextcloud Calendar to version 4.7.19, 5.5.6, or 6.0.1.