CVE-2026-52841 Details
Description
Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Google::oauth` at `application/controllers/Google.php:278` stores its URL-supplied `provider_id` in the session, and `oauth_callback` saves the issued Google OAuth token against that row without checking the caller owns the provider. Any logged-in backend user (admin, provider, or secretary) rebinds a peer provider's Google sync to a Google account they control. The peer's appointments then sync into the attacker's calendar with each customer's name and email attached as attendee data. Version 1.6.0 patches the issue.
A vulnerability in Easy!Appointments versions prior to 1.6.0 allows for unauthorized re-binding of Google Calendar synchronization for providers. The issue arises in the Google controller, where the provider ID is stored in the session without validation. This flaw enables any logged-in backend user (admin, provider, or secretary) to link a peer provider's Google sync to their own Google account. As a result, the attacker's calendar receives the victim's appointments, complete with customer names and emails as attendee details.
Users can update to Easy!Appointments version 1.6.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 14, 2026CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-8hm4-r66f-29wr | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/alextselegidis/easyappointments/commit/4b2d245d2cd2058dc76e05f6eb65b26699268471 | [email protected] | Source CodeVendor |
| https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-8hm4-r66f-29wr | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Easy!Appointments | <= 1.5.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | New CVE Received | [email protected] |
| Jul 14, 2026 | CVE Modified | CISA-ADP |