CVE-2026-14214

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar versions prior to 2.4.4

Description An issue exists in the customer import feature where the software fails to restrict which fields can be written. This allows a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request through a mass assignment technique. Mass assignment is a vulnerability where an application takes user-provided data and binds it to an internal object without proper filtering.

Recommendations Update to version 2.4.4 or later.