Easy!Appointments CVE-2026-52840

Exploitation requires an active, authenticated backend account with admin, provider, or secretary role in Easy!Appointments - unauthenticated attackers cannot reach the vulnerable endpoint. The CalDAV synchronization feature must be available to the logged-in user, which is part of the standard backend interface and requires no special configuration to enable. The attacker supplies an arbitrary value for the caldav_url POST parameter; no additional configuration changes or elevated operating system permissions are needed beyond the web application credential. Exploitation is further limited by: (1) PR:H authentication gate preventing external unauthenticated access; (2) semi-blind response leakage of approximately 120 bytes per request, requiring many probes to map internal hosts meaningfully; (3) unchanged scope (S:U), meaning the vulnerability does not directly pivot into another security domain. Deployments with strict network egress controls blocking outbound RFC1918, loopback, and link-local traffic from the application server are not exploitable for internal network reconnaissance.

The CVSS 3.1 score of 2.7 (Low) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N accurately reflects constrained real-world risk. The PR:H requirement is the dominant mitigating factor - exploitation is gated on possession of a valid backend account, restricting the threat to malicious insiders or attackers who have already compromised credentials through a separate vector. The C:L rating is appropriate given only ~120 bytes of semi-blind response leakage per probe, which significantly throttles reconnaissance throughput compared to a full-response SSRF. No EPSS data was supplied in the input and cannot be cited; however, the combination of required authentication, niche product footprint, and partial-blind data return suggests exploitation probability is low. This CVE is not in CISA KEV and no public POC has been identified at time of analysis, so no active exploitation is confirmed. The unchanged scope (S:U) means the SSRF does not cross into another system's trust domain by itself. Real-world prioritization should be LOW for most deployments, escalating to MEDIUM if the application server has network adjacency to sensitive internal services (e.g., cloud metadata endpoints, CI/CD agents, or internal APIs) that yield meaningful data within 120 bytes.

A malicious secretary with a valid Easy!Appointments backend account navigates to the CalDAV settings page and submits a crafted caldav_url such as http://169.254.169.254/latest/meta-data/ or http://192.168.1.1:8500/v1/agent/members. The application server dispatches a Guzzle REPORT request to the target, and the exception handler returns the upstream HTTP status code along with approximately 120 bytes of the response body in the JSON error message, revealing the presence and partial content of internal services. By iterating across common RFC1918 addresses and ports, the attacker can map services reachable from the application host without any publicly available exploit code.