CVE-2026-57747

2th percentile — higher than 2% of all known CVEs

An unauthenticated Cross Site Request Forgery (CSRF) vulnerability exists in Booked version 3.0.0 and earlier. An attacker can trick a logged-in administrator into performing unintended actions without their knowledge.

The risk involves unauthorized operations being executed in the context of an administrator session, potentially leading to configuration changes, data deletion, or privilege escalation.

Immediately update Booked to a version newer than 3.0.0 that includes a fix for the CSRF vulnerability. Additionally, implement CSRF protection mechanisms such as anti-CSRF tokens.