Threat Intelligence Database

Easy!Appointments versions up to 1.6.0 have an authorization bypass vulnerability in the Booking::register() function. This flaw allows unauthenticated attackers to modify any appointment by providing an appointment ID without the required hash. Attackers can enumerate appointment IDs, manipulate appointment details, reassign appointments to attacker-controlled customers, and obtain management hashes for further unauthorized rescheduling or cancellation.

Easy!Appointments version 1.5.2 and earlier contain an excessive data exposure vulnerability in the customer search endpoint. Authenticated users can access appointment hashes of other users, which can be exploited to modify or delete appointments belonging to other providers. This vulnerability allows appointment takeover. The issue is fixed in version 1.6.0.

Easy!Appointments versions prior to 1.6.0 contain an authorization bypass vulnerability in the Google OAuth integration. The application stores a URL-supplied provider_id in the session without verifying ownership, allowing any logged-in backend user to rebind another provider's Google sync to their own account. This results in unauthorized access to peer providers' appointment data, including customer names and emails. Version 1.6.0 addresses this issue.

Easy!Appointments versions prior to 1.6.0 contain a server-side request forgery (SSRF) vulnerability in the Caldav::connect_to_server function. This function passes a user-controlled URL to a Guzzle HTTP client call without validating the scheme or host, allowing authenticated backend users to make requests to internal network addresses. The vulnerability is semi-blind, as some response data is returned in error messages. Version 1.6.0 includes a patch for this issue.

Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the `appointments/search` response, proving that provider isolation is an intended security boundary. However, the direct mutation endpoints `appointments/store` and `appointments/update` only check generic appointment privileges and never verify that the submitted `id_users_provider` belongs to the current session. A normal authenticated provider can inject new appointments into another provider's schedule via `store`, or reassign existing appointments into a foreign provider's calendar via `update`. The `store` path contains an additional write-before-crash bug: the unauthorized row is committed to the database before the controller crashes on a type error, so the attacker receives an error response while the foreign appointment is already persisted. Version 1.6.0 patches the issue.

Easy!Appointments versions prior to 1.6.0 contain a stored cross-site scripting (XSS) vulnerability. An authenticated administrator can inject malicious HTML or JavaScript into the 'booking disabled' message, which is then rendered without sanitization on the public booking page. This allows stored XSS to be triggered in unauthenticated visitors when the booking page is accessed. The issue is fixed in version 1.6.0.

Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the entire customer record as inline JavaScript (`const vars = {... "customer_data": {...}, ...}`) without authentication and without field whitelisting. Anyone in possession of the 12-character `appointment_hash` — which appears in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links — can read every column of that customer's row in the `ea_users` table. Version 1.6.0 contains a patch.

CVE-2026-23622 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability affecting Easy! Appointments versions 1.5.2 and earlier. The vulnerability arises because the application only enforces CSRF protection on POST requests, while some state-changing operations accept parameters via GET requests, allowing attackers to craft malicious GET requests to perform unauthorized actions. Exploitation can lead to creation of admin accounts, modification of admin credentials, and full admin account takeover without requiring authentication. This flaw significantly compromises confidentiality, integrity, and availability of affected systems. European organizations using Easy! Appointments self-hosted scheduler are at risk, especially those with public-facing installations. Mitigation involves applying patches when available, restricting state-changing operations to POST methods only, and implementing CSRF tokens for all state-changing endpoints regardless of HTTP method.

HighVulnerabilityGermanyFranceItaly+5#cve#cve-2026-23622#cwe-352