LibreBooking: open source resource scheduling, and two security upgrades you must apply

A fork of Booked Scheduler that diverged after 2020

LibreBooking is a PHP application for scheduling shared resources, and its origin matters when you evaluate it. It is a fork of Booked Scheduler, based on the last open-source version of that project released in 2020, and the README states that the fork has evolved significantly and diverged from the original since then. The develop branch carries the latest code, and the default branch of the repository is develop, so anyone cloning the repository gets the current work rather than a tagged release. What you get is a resource reservation system with a responsive Bootstrap 5 interface, aimed at organisations that book rooms, equipment or vehicles, with the flexibility and extensibility the project description promises.

Reservations with waitlists, quotas and reporting underneath

The feature list is where the difference between a calendar and a booking system shows. Multi-resource booking and waitlists are both present, so a request for an overlapping slot can queue instead of failing. Role-based access control decides who may reserve what, and quotas and credits bound how much a person or group may hold, which is the mechanism that stops one team from taking every slot in the building. Granular usage reporting answers who booked what and when, and the list view uses DataTables for advanced listings. Two smaller features matter more than they sound: Outlook and Thunderbird integration through ics files, so reservations land in a person's own calendar, and a plugin-ready architecture, which is the extension point an organisation would use for site specific rules. A live demo instance is published in the documentation, with admin and user credentials, and it resets every twenty minutes.

Two critical takeovers, and no backports to older branches

The README leads with two security warnings, and they are the most important thing to read. Versions before 7.0.0 contain a critical vulnerability that lets an unauthenticated attacker take over an administrator account, with the immediate mitigation being to delete Web/install/migrate.php or block access to it. Versions before 7.1.0 contain a second critical vulnerability that lets an unauthenticated attacker sign in as another user, including an administrator, by forging the Remember Me login cookie, and the mitigation there is to configure the web server or reverse proxy to strip the persist_login cookie from incoming requests. In both cases the project says security fixes are not backported, so no fix will be released for 6.x or 7.0.x. Version 7.1.0 goes further and removes the Remember Me option entirely, so users sign in again once their session ends. A security advisory link is provided for each issue, including how to check whether an installation was already compromised.

PHP 8.2, Apache and MySQL 8.0 for a manual install

The manual installation requirements are listed precisely. PHP 8.2 or newer is required with the ctype, curl, fileinfo, intl, json, mbstring, mysqli, openssl, pdo, pdo_mysql, tokenizer and xml extensions, and three more are optional: bcmath for Active Directory authentication, gd for image processing and ldap for LDAP authentication. The web server is Apache 2.4 or newer. Other servers including Nginx may work when configured with equivalent routing and access control rules, but the README is explicit that they are not currently supported or tested by the project. The database is MySQL 8.0 or newer, or MariaDB 10.6 or newer, and Composer handles PHP dependencies while Git is optional but useful for updates. Full setup steps live in the INSTALLATION document in the repository's docs directory.

Docker for evaluation, environment variables for configuration

A container route exists through a separate LibreBooking/docker repository, and the README gives three lines to bring it up:

git clone https://github.com/LibreBooking/docker.git
cd docker
docker-compose up -d

That is the quickest way to look at the application before committing a host. Configuration itself runs through environment variables, and the .env.example file in the repository root is the reference for them. The naming is systematic, with an LB_ prefix, and the examples cover the application title, debug mode, the administrator email and the company name shown in the page header. Locale defaults are equally explicit:

LB_DEFAULT_TIMEZONE='Europe/London'
LB_DEFAULT_LANGUAGE='en_us'

The same file can restrict which languages appear in the selector, with a comment noting that the codes must match those defined in lang/AvailableLanguages.php and that a missing default language falls back to en_us and logs an error. There is also a separate password that guards the installation wizard under Web/install/, and leaving it empty disables that wizard, which is worth doing on a live instance.

A layered PHP codebase with a modern frontend toolchain

The repository layout shows the application's shape. Directories named Controls, Domain, Pages, Presenters, Web, WebServices, Jobs, lib, plugins and src separate the request handling, the domain model, the user interface, the SOAP style web services, the background jobs and the extension points, with a database_schema directory holding the schema and a lang directory holding translations. Tests sit in tests/, run under PHPUnit with a phpunit.xml.dist, and static analysis is configured through phpstan.neon and phpstan_next.neon, with php-cs-fixer for style. The frontend has its own toolchain in package.json: eslint for JavaScript, stylelint for CSS and prettier for formatting, with Node 20.19.0 or newer required, and commit messages are checked by commitlint under a conventional configuration. The licence is GPL v3, the project is not archived, and the last push was on 2026-10-17, with v7.1.0 published on 2026-10-13.

Editorial conclusion

LibreBooking suits an organisation that needs room, equipment or vehicle reservations with quotas, waitlists and calendar export, and that can host PHP and MySQL itself. It does not suit a deployment that still needs the Remember Me login feature, since version 7.1.0 removes that option, nor one that cannot move to Apache with equivalent routing. Before deploying anything, upgrade to 7.1.0 or later, remove the persist_login cookie at your proxy if you cannot upgrade immediately, and delete Web/install/migrate.php on any installation still running 6.x.

Frequently asked questions

Official sources

1. LibreBooking/librebooking on GitHub
2. License: GPL-3.0
3. Project website
4. README
5. Releases