Easy!Appointments EUVD-2026-43726

Exploitation requires an authenticated account on the target Easy!Appointments instance (CVSS PR:L) and access to the customers search endpoint, which returns appointment hashes of other users beyond the caller's authorization scope; possession of a leaked hash is the concrete prerequisite for the follow-on modify/delete actions. Limiting factors: the attacker must first obtain valid credentials or self-register, so instances that disable public account creation or restrict the search endpoint to trusted staff materially reduce risk; no user interaction is needed and the network attack vector means any reachable authenticated user can attempt it. Affected configuration is default behavior of version 1.5.2 - no special non-default feature toggle is required beyond having an account.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) signals a network-reachable, low-complexity attack that requires only a low-privileged authenticated account and no user interaction, with limited confidentiality loss but high integrity impact - consistent with the description in which a leaked hash enables tampering with other providers' bookings. No EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; the absence of a KEV listing means there is no confirmation of active exploitation. This is a genuine multi-tenant authorization weakness rather than an inflated high-CVSS issue, but it is gated behind having a valid application account, which limits the realistic attacker population to registered users (e.g., customers or staff on a shared instance). Note the vector omits availability impact even though deleting others' appointments is arguably an availability harm to those victims - defenders may reasonably treat the integrity/availability blast radius as broader than A:N implies.

A registered low-privileged user on a shared Easy!Appointments 1.5.2 instance calls the customers search endpoint and receives appointment hashes belonging to other users and providers in the response. Reusing those hashes against the appointment modify/delete functions, the attacker reschedules or cancels bookings they do not own, disrupting other providers' schedules. No public exploit code is known, and the attack requires only an authenticated session with low complexity and no user interaction.