SB2026042882 - Multiple vulnerabilities in Easy!Appointments

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026042882

SB2026042882 - Multiple vulnerabilities in Easy!Appointments

Published: April 28, 2026 Updated: June 15, 2026

Security Bulletin ID SB2026042882
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 14% Low 86%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Cross-site request forgery (CVE-ID: CVE-2026-23622)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/U:Clear


The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in application/core/EA_Security.php::csrf_verify(). A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.


2) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-52841)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information and modify appointment data.

The vulnerability exists due to improper access control in the Google OAuth provider binding flow when processing a user-supplied provider_id during OAuth setup and callback handling. A remote privileged user can bind a peer provider's Google sync to a Google account they control to disclose sensitive information and modify appointment data.

User interaction is required to complete the Google OAuth consent flow, and only instances with Google Calendar OAuth configured are vulnerable.


3) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-52840)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information about the deployment's internal network.

The vulnerability exists due to server-side request forgery in Caldav::connect_to_server when processing a user-supplied caldav_url. A remote privileged user can send a specially crafted request to disclose sensitive information about the deployment's internal network.

The returned error message can include the upstream status code and a small portion of the response body, making the SSRF semi-blind.


4) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-52839)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to modify appointments in another provider's schedule.

The vulnerability exists due to improper access control in the appointments/store and appointments/update endpoints when handling appointment modification requests with a user-controlled id_users_provider value. A remote privileged user can submit a crafted appointment request to modify appointments in another provider's schedule.

In the store path, the unauthorized appointment row is committed before the controller crashes, so the change persists even if the request returns an internal server error.


5) Cross-site scripting (CVE-ID: CVE-2026-52838)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary JavaScript in a victim's browser.

The vulnerability exists due to cross-site scripting in the public booking_message view when rendering the stored disable_booking_message setting. A remote privileged user can store malicious HTML or JavaScript in this field to execute arbitrary JavaScript in a victim's browser.

User interaction is required to open the public booking page while disabled-booking mode is enabled.


6) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-52837)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to authorization bypass through user-controlled key in the booking reschedule view when handling a GET request to /index.php/booking/reschedule/{appointment_hash}. A remote attacker can send a request with a valid appointment hash to disclose sensitive information.

The response embeds the full customer record as inline JavaScript, exposing fields beyond those required by the reschedule interface.


7) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to modify or delete other users' appointments.

The vulnerability exists due to exposure of sensitive information to an unauthorized actor in the customers search endpoint when handling authenticated search requests. A remote user can obtain appointment hashes belonging to other users and reuse them to modify or delete other users' appointments.

The exposed hashes can also be used to view appointment information through appointment management functionality.


Remediation

Install update from vendor's website.

References