CVE-2026-55651 describes an excessive data exposure vulnerability (CWE-200) in the Easy!Appointments self-hosted scheduler. In versions prior to 1.6.0, the customers search endpoint leaks appointment hashes to authenticated users, enabling them to manipulate appointments of other providers by using these hashes. This leads to unauthorized modification or deletion of appointments, effectively allowing appointment takeover. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity but not availability. Version 1.6.0 addresses this issue.

An authenticated user can obtain sensitive appointment hashes of other users, which can be leveraged to modify or delete appointments of other providers. This compromises the integrity of appointment data and allows unauthorized appointment takeover. Confidentiality is also impacted due to exposure of sensitive information. There is no impact on availability. No known exploits in the wild have been reported.

Upgrade Easy!Appointments to version 1.6.0 or later, where this vulnerability is fixed. Since the vendor advisory or patch links are not explicitly provided, confirm the upgrade from official sources before deployment. No temporary or alternative mitigations are indicated.