PT-2026-58069 · Unknown · Easyappointments

Published 2026-07-14 · Updated 2026-07-14 · CVE-2026-52841

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Easy!Appointments versions prior to 1.6.0

Description An issue exists where the Google::oauth function at application/controllers/Google.php:278 stores a URL-supplied provider id in the session. Subsequently, the oauth callback function saves the issued Google OAuth token to that row without verifying if the caller owns the provider. This allows any authenticated backend user, such as an admin, provider, or secretary, to rebind another provider's Google synchronization to a Google account under their control. Consequently, the affected provider's appointments, including customer names and emails as attendee data, are synchronized into the attacker's calendar.

Recommendations Update to version 1.6.0.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-52841

GHSA-8HM4-R66F-29WR

Affected Products

Easyappointments

References · 5

• 🔥 https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-8hm4-r66f-29wr · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52841.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-52841 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-52841 · Security Note
• https://github.com/alextselegidis/easyappointments/commit/4b2d245d2cd2058dc76e05f6eb65b26699268471 · Note