CVE-2026-17023 Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback
Unauthenticated attackers can hijack Google Calendar connections by overwriting stored OAuth tokens due to missing capability checks and state validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-17023?
CVE-2026-17023 is a medium-severity missing authorization vulnerability in Unknown Salon Booking System, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.
Weakness: CWE-284
Which versions are affected by CVE-2026-17023?
How do I fix CVE-2026-17023?
No fix has been published for CVE-2026-17023 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-17023 being exploited?
There is no known exploitation of CVE-2026-17023 in the wild and no public exploit code.
Sources
Also known as GHSA-3hmc-2cg9-g3wx.