Vulnerability Description
Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the entire customer record as inline JavaScript (`const vars = {... "customer_data": {...}, ...}`) without authentication and without field whitelisting. Anyone in possession of the 12-character `appointment_hash` — which appears in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links — can read every column of that customer's row in the `ea_users` table. Version 1.6.0 contains a patch.
Related Weaknesses (CWE)
References
- https://github.com/alextselegidis/easyappointments/commit/40bb0b31b531540bc9006e
- https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-xgr6
- https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-xgr6
FAQ
What is CVE-2026-52837?
CVE-2026-52837 is a documented vulnerability. Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking:...
How severe is CVE-2026-52837?
CVSS scoring is not yet available for CVE-2026-52837. Check NVD for updates.
Is there a patch for CVE-2026-52837?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.