EUVD-2026-43692
GHSA-xgr6-pqjv-3pf8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Endpoint is unauthenticated and network-accessible with no complexity; confidentiality is Low because exposure is bounded to one customer record per hash with no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at /index.php/booking/reschedule/{appointment_hash} (handled by Booking::index()) embeds the entire customer record as inline JavaScript (const vars = {... "customer_data": {...}, ...}) without authentication and without field whitelisting. Anyone in possession of the 12-character appointment_hash - which appears in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links - can read every column of that customer's row in the ea_users table. Version 1.6.0 contains a patch.
AnalysisAI
The reschedule endpoint in Easy!Appointments 1.5.2 and earlier exposes the complete customer database record to any party holding the 12-character appointment hash, with no authentication check and no field whitelisting on the ea_users row. These hashes are deliberately distributed to customers in reschedule emails, embedded in confirmation page URLs, and visible in operator calendar links, which means the effective attacker pool is anyone who has ever received or forwarded a booking email. The fix is available in version 1.6.0 per the GitHub security advisory; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Technical ContextAI
Easy!Appointments is a PHP-based self-hosted appointment scheduling application (CPE: cpe:2.3:a:alextselegidis:easyappointments). The vulnerability resides in the Booking::index() controller, which serves the reschedule view at /index.php/booking/reschedule/{appointment_hash}. This handler serializes the entire customer row from the ea_users database table into inline page JavaScript as const vars = { ..., customer_data: {...}, ... } before returning the HTML response. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): no authentication is required to reach the endpoint, no allowlist restricts which database columns are included in the serialized output, and the 12-character appointment hash embedded in email links is the sole access control token - a shared secret that is intentionally distributed and therefore cannot serve as a confidentiality boundary.
RemediationAI
Upgrade to Easy!Appointments 1.6.0, which contains the vendor-released patch per the GitHub security advisory at https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-xgr6-pqjv-3pf8. If an immediate upgrade is not feasible, the most effective compensating control is to restrict access to the /index.php/booking/reschedule/ path at the web server or reverse-proxy layer - note this will break legitimate customer reschedule functionality and should be considered a temporary measure only. Alternatively, operators with access to the source can patch the Booking::index() controller directly to whitelist only the minimum customer fields required by the reschedule form before the inline JavaScript variable is rendered. Important: the commit diff provided in the reference data (629a0415f54f75556c17f4f5d9c77fda1fdbdeae) addresses a separate stored XSS issue in the booking_message view, not this information disclosure; ensure the correct 1.6.0 release is applied rather than backporting that specific commit.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today