CVE-2026-52838

Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 allow administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the `disable_booking_message` setting via a rich-text editor and later passed directly to the public `booking_message` view without escaping or sanitization. An authenticated administrator can store HTML or JavaScript in this field, enable disabled-booking mode, and trigger stored XSS in every unauthenticated visitor who opens the public booking page. Version 1.6.0 fixes the issue.

• CWE-79

• https://github.com/alextselegidis/easyappointments/commit/629a0415f54f75556c17f4f5d9c77fda1fdbdeae
• https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-996f-334j-67g7
• https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-996f-334j-67g7

Published

Jul 14, 2026

Last Modified

Jul 14, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52815Gogs is an open source self-hosted Git service. Prior to 0.1…5.5
• CVE-2026-52816Gogs is an open source self-hosted Git service. Prior to 0.1…5.4
• CVE-2026-5282Out of bounds read in WebCodecs in Google Chrome prior to 14…8.1
• CVE-2026-5283Inappropriate implementation in ANGLE in Google Chrome prior…6.5
• CVE-2026-52830fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1,…9.4
• CVE-2026-52837Easy!Appointments is a self hosted appointment scheduler. In…6.9
• CVE-2026-52839Easy!Appointments is a self hosted appointment scheduler. Ve…3.3
• CVE-2026-5284Use after free in Dawn in Google Chrome prior to 146.0.7680.…7.5
• CVE-2026-52840Easy!Appointments is a self hosted appointment scheduler. In…2.7
• CVE-2026-52841Easy!Appointments is a self hosted appointment scheduler. In…3.1
• CVE-2026-52842Lightpanda is a headless browser designed for AI and automat…9.3
• CVE-2026-52843Lightpanda is a headless browser designed for AI and automat…9.3