EUVD-2026-43726
GHSA-4vmm-5qvc-w5p7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Network-reachable endpoint needs only a low-privileged authenticated account (PR:L, AC:L, UI:N); hash leak is limited confidentiality (C:L) but enables high-impact tampering with others' appointments (I:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover. Version 1.6.0 fixes the issue.
AnalysisAI
Broken object-level authorization in Easy!Appointments 1.5.2 lets any authenticated user query the customers search endpoint to harvest the appointment hash tokens of other users and providers. Because these hashes act as the access control for appointment operations, an attacker can then edit or delete appointments they do not own, achieving a full Appointments Takeover across other providers. No public exploit identified at time of analysis; the flaw is fixed in version 1.6.0.
Technical ContextAI
Easy!Appointments is a PHP/MySQL self-hosted booking platform (CPE cpe:2.3:a:alextselegidis:easyappointments) where each appointment is referenced by a per-record hash that also functions as a capability token for viewing, rescheduling, or cancelling that booking. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the customers search endpoint returns more object fields than the requesting user is entitled to, leaking the appointment hashes of unrelated users. Since the application trusts possession of the hash rather than verifying the caller's ownership of the appointment, an information-disclosure bug escalates into an integrity problem - the leaked identifier is directly reusable against the appointment modify/delete flows.
RemediationAI
Vendor-released patch: upgrade to Easy!Appointments 1.6.0, which fixes the excessive data exposure in the customers search endpoint per advisory GHSA-4vmm-5qvc-w5p7 (https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-4vmm-5qvc-w5p7). If an immediate upgrade is not possible, reduce exposure by restricting who holds authenticated accounts on the instance and by placing the customers search endpoint behind additional access controls or a reverse-proxy allowlist so untrusted or self-registered users cannot reach it; on multi-tenant deployments consider disabling public/self-service account creation until patched. These controls narrow the attacker pool but do not remove the underlying object-level authorization flaw, so upgrading remains the only complete fix.
More in Easyappointments
View allAn issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php f
Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated critical severi
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments p
Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated high severity (CVSS 8.8), th
API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated high severity (CVSS
Cross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute arbit
Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated medium severity (CVSS
Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated medium se
Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated medium se
Authorization Bypass Through User-Controlled Key in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Ra
Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated low severity (CVSS 3.8), this
The reschedule endpoint in Easy!Appointments 1.5.2 and earlier exposes the complete customer database record to any part
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today