PT-2026-58044 · Alextselegidis · Easyappointments

Published 2026-07-14 · Updated 2026-07-14 · CVE-2026-52837

Mitre

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at /index.php/booking/reschedule/{appointment hash} (handled by Booking::index()) embeds the entire customer record as inline JavaScript (const vars = {... "customer data": {...}, ...}) without authentication and without field whitelisting. Anyone in possession of the 12-character appointment hash — which appears in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links — can read every column of that customer's row in the ea users table. Version 1.6.0 contains a patch.

Fix

IDOR

Information Disclosure

Weakness Enumeration

CWE-639

CWE-200

Related Identifiers

CVE-2026-52837

Affected Products

Easyappointments

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-52837 · Security Note
• https://github.com/alextselegidis/easyappointments/commit/629a0415f54f75556c17f4f5d9c77fda1fdbdeae · Note
• https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-xgr6-pqjv-3pf8 · Note