CVE-2026-52841
LowCVSS 3.1Summary
A vulnerability in Easy!Appointments prior to version 1.6.0 allows any logged-in backend user (admin, provider, secretary) to hijack another provider's Google sync. The attacker can replace the OAuth token, causing customer data (name, email) to be sent to their own Google calendar.
Risk Assessment
The risk involves leakage of personally identifiable information (PII) of customers to an unauthorized Google calendar, compromising confidentiality and potentially leading to GDPR compliance issues.
Recommendation
Immediately upgrade Easy!Appointments to version 1.6.0 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Google::oauth` at `application/controllers/Google.php:278` stores its URL-supplied `provider_id` in the session, and `oauth_callback` saves the issued Google OAuth token against that row without checking the caller owns the provider. Any logged-in backend user (admin, provider, or secretary) rebinds a peer provider's Google sync to a Google account they control. The peer's appointments then sync into the attacker's calendar with each customer's name and email attached as attendee data. Version 1.6.0 patches the issue.