In Easy!Appointments before version 1.6.0, the Google OAuth implementation at application/controllers/Google.php improperly trusts a URL-supplied provider_id stored in the session. The oauth_callback function saves the issued Google OAuth token against this provider_id without verifying that the caller owns the provider. Consequently, any authenticated backend user (admin, provider, or secretary) can rebind another provider's Google sync to their own Google account. This leads to unauthorized synchronization of the peer provider's appointments, exposing customer attendee data such as names and emails to the attacker. The vulnerability is fixed in version 1.6.0.

An authenticated backend user with any role can manipulate the Google OAuth token binding for other providers, causing their appointments and associated customer data to be synced to the attacker's Google calendar. This results in unauthorized disclosure of customer names and emails. The CVSS score is 3.1 (low severity), reflecting limited impact due to required authentication and high attack complexity.

Upgrade Easy!Appointments to version 1.6.0 or later, where the issue is fixed. No official patch or temporary fix is documented beyond this version upgrade. Since this is a self-hosted product, administrators should apply the update promptly to prevent exploitation.