The vulnerability (CVE-2026-52840) exists in Easy!Appointments before version 1.6.0 in the Caldav::connect_to_server method located in application/controllers/Caldav.php. This method forwards the caldav_url parameter from authenticated backend users (admin, provider, or secretary) directly to a Guzzle HTTP REPORT request without validating the URL's scheme or host. This lack of validation permits SSRF attacks targeting loopback, RFC1918 private, and link-local addresses within the deployment's network. The error handling path returns the upstream HTTP status code and approximately 120 bytes of the response body in a JSON message field, enabling semi-blind SSRF exploitation. The vulnerability is addressed in version 1.6.0.

An authenticated backend user can exploit this SSRF vulnerability to send crafted HTTP REPORT requests to internal network resources, including loopback and private IP addresses. This could potentially allow information disclosure about internal services or network topology. The CVSS score is 2.7 (low severity), reflecting limited confidentiality impact and no integrity or availability impact. There are no known exploits in the wild.

Upgrade Easy!Appointments to version 1.6.0 or later, where this SSRF vulnerability has been patched. Since this is a self-hosted product, administrators should apply the official update to remediate the issue. No other vendor advisory or temporary fixes are provided. Patch status is not explicitly confirmed beyond the version bump, so verify with the vendor's release notes.