In Easy!Appointments before version 1.6.0, the Google OAuth implementation at application/controllers/Google.php improperly trusts a URL-supplied provider_id parameter and stores it in the session. The oauth_callback function then saves the issued Google OAuth token against this provider_id without verifying that the caller owns the provider. Consequently, any authenticated backend user (admin, provider, or secretary) can rebind another provider's Google calendar sync to their own Google account. This leads to unauthorized synchronization of the peer provider's appointments, exposing customer attendee data such as names and emails. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key).

An attacker with any backend login privileges can hijack another provider's Google calendar synchronization, gaining unauthorized access to appointment details including customer names and email addresses. The confidentiality of customer data is compromised, but the vulnerability does not affect availability or integrity beyond this scope. The CVSS score is 3.1 (low severity), reflecting the requirement for authenticated access and high attack complexity.

Upgrade Easy!Appointments to version 1.6.0 or later, where this authorization bypass vulnerability has been fixed. There is no official patch advisory provided, but the vendor has released version 1.6.0 to address the issue. Until upgrading, restrict backend user privileges to trusted personnel only to reduce risk.