CVE-2026-52839
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
A vulnerability in Easy!Appointments before version 1.6.0 allows an authenticated provider to inject appointments into another provider's schedule. The `appointments/store` and `appointments/update` endpoints do not verify that the provider ID belongs to the current session, breaking provider isolation. Additionally, the `store` path has a write-before-crash bug that persists unauthorized data in the database.
Risk Assessment
The organization faces a risk of schedule integrity compromise, leading to appointment conflicts, loss of customer trust, and potential legal issues due to unauthorized data access.
Recommendation
Immediately upgrade Easy!Appointments to version 1.6.0 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the `appointments/search` response, proving that provider isolation is an intended security boundary. However, the direct mutation endpoints `appointments/store` and `appointments/update` only check generic appointment privileges and never verify that the submitted `id_users_provider` belongs to the current session. A normal authenticated provider can inject new appointments into another provider's schedule via `store`, or reassign existing appointments into a foreign provider's calendar via `update`. The `store` path contains an additional write-before-crash bug: the unauthorized row is committed to the database before the controller crashes on a type error, so the attacker receives an error response while the foreign appointment is already persisted. Version 1.6.0 patches the issue.