CVE-2026-52837 Details
Description
Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the entire customer record as inline JavaScript (`const vars = {... "customer_data": {...}, ...}`) without authentication and without field whitelisting. Anyone in possession of the 12-character `appointment_hash` — which appears in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links — can read every column of that customer's row in the `ea_users` table. Version 1.6.0 contains a patch.
A vulnerability in Easy!Appointments versions through 1.5.2 allows for unauthorized disclosure of customer personal information. The issue arises in the booking reschedule view, which embeds the entire customer record as inline JavaScript without authentication or proper field whitelisting. This vulnerability can be exploited by anyone with the 12-character appointment hash, which is easily accessible through reschedule emails, confirmation page URLs, and operator-side calendar links. The exposed data includes sensitive information such as email, phone number, address, timezone, and custom fields. Version 1.6.0 addresses this vulnerability by implementing field whitelisting.
Users can update to Easy!Appointments version 1.6.0, which includes the necessary patch. Instructions for updating can be found in the project's official documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 14, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-xgr6-pqjv-3pf8 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/alextselegidis/easyappointments/commit/40bb0b31b531540bc9006efce4220eb0a437ed2b | [email protected] | |
| https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-xgr6-pqjv-3pf8 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Easy!Appointments | <= 1.5.2 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | CVE Modified | [email protected] |
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 14, 2026 | New CVE Received | [email protected] |