CVE-2026-52837

Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the entire customer record as inline JavaScript (`const vars = {... "customer_data": {...}, ...}`) without authentication and without field whitelisting. Anyone in possession of the 12-character `appointment_hash` — which appears in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links — can read every column of that customer's row in the `ea_users` table. Version 1.6.0 contains a patch.

• CWE-200
• CWE-639

• https://github.com/alextselegidis/easyappointments/commit/40bb0b31b531540bc9006efce4220eb0a437ed2b
• https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-xgr6-pqjv-3pf8
• https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-xgr6-pqjv-3pf8

Published

Jul 14, 2026

Last Modified

Jul 29, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52814Gogs is an open source self-hosted Git service. Prior to 0.1…5.5
• CVE-2026-52815Gogs is an open source self-hosted Git service. Prior to 0.1…5.5
• CVE-2026-52816Gogs is an open source self-hosted Git service. Prior to 0.1…5.4
• CVE-2026-5282Out of bounds read in WebCodecs in Google Chrome prior to 14…8.1
• CVE-2026-5283Inappropriate implementation in ANGLE in Google Chrome prior…6.5
• CVE-2026-52830fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1,…9.4
• CVE-2026-52838Easy!Appointments is a self hosted appointment scheduler. Ve…2.6
• CVE-2026-52839Easy!Appointments is a self hosted appointment scheduler. Ve…3.3
• CVE-2026-5284Use after free in Dawn in Google Chrome prior to 146.0.7680.…7.5
• CVE-2026-52840Easy!Appointments is a self hosted appointment scheduler. In…2.7
• CVE-2026-52841Easy!Appointments is a self hosted appointment scheduler. In…3.1
• CVE-2026-52842Lightpanda is a headless browser designed for AI and automat…9.3