Authorization bypass through user-controlled key in Easy!Appointments - CVE-2026-52839
Published: June 15, 2026
Vulnerability identifier: #VU134526
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-52839
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to modify appointments in another provider's schedule.
The vulnerability exists due to improper access control in the appointments/store and appointments/update endpoints when handling appointment modification requests with a user-controlled id_users_provider value. A remote privileged user can submit a crafted appointment request to modify appointments in another provider's schedule.
In the store path, the unauthorized appointment row is committed before the controller crashes, so the change persists even if the request returns an internal server error.
Affected software
Easy!Appointments
How to mitigate CVE-2026-52839
Install security update from vendor's website.
Easy!Appointments - update to 1.6.0