Easy!Appointments CVE-2026-52837

The reschedule endpoint must be network-accessible (the default configuration for any Internet-facing Easy!Appointments deployment). The attacker must possess a valid 12-character appointment_hash for at least one appointment on the target instance. These hashes are not secret by design: they appear in plain text in reschedule notification emails sent to customers, in confirmation page URLs displayed post-booking, and in operator-side calendar links - meaning any email recipient, email forwarder, or person with view access to a customer's inbox can perform exploitation. No authentication, no special software, and no non-default configuration are required. The primary limiting factor is per-customer hash scope: each hash exposes only one customer's record, and bulk enumeration of the 12-character hash space would be required to access arbitrary customer records at scale.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the endpoint is remotely exploitable with no prerequisites, and the VC:L rating reflects that exploitation is bounded to one customer record per hash rather than bulk database access, yielding a score of 6.9. In practice, the risk is higher than the score alone conveys: appointment hashes are deliberately sent to customers in emails, which means legitimate recipients, any email intermediaries, or anyone who receives a forwarded booking link can trivially retrieve another person's PII. No EPSS data was provided in the input, so exploitation probability cannot be quantified. The vulnerability is not in CISA KEV, and no POC has been identified, indicating no known active or mass exploitation. Despite the absence of weaponized code, the data exposed - the full ea_users row, which may include names, phone numbers, notes, and other PII - creates meaningful GDPR, HIPAA, or CCPA compliance exposure for operators offering healthcare or regulated-industry scheduling. No conflicting signals were identified between the CVSS vector and the description.

An attacker who receives a legitimate reschedule email for any appointment on a target instance extracts the 12-character hash from the embedded link. They then issue a plain HTTP GET request to /index.php/booking/reschedule/{hash} using a browser or curl, and the HTML response body contains an inline JavaScript object embedding the full ea_users customer record. No tools, credentials, or additional steps are required beyond making the HTTP request.