CVE-2026-52837: alextselegidis easyappointments

Vulnerability summary

CVE-2026-52837 is a medium (CVSS 6.9) vulnerability in alextselegidis easyappointments. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.8% of scored vulnerabilities.

Timeline

1. 14-07-2026
   PublishedVulnerability first disclosed.
2. 29-07-2026
   Last modifiedVulnerability information updated.

Description

Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the entire customer record as inline JavaScript (`const vars = {... "customer_data": {...}, ...}`) without authentication and without field whitelisting. Anyone in possession of the 12-character `appointment_hash` — which appears in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links — can read every column of that customer's row in the `ea_users` table. Version 1.6.0 contains a patch.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.