CVE-2026-52837: Easy!Appointments Unauthenticated Customer PII Disclosure on Booking Reschedule Page
Summary
CVE-2026-52837: Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page. Affects alextselegidis/easyappointments versions < 1.5.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Easy!Appointments is an open-source appointment scheduling software that allows businesses to manage bookings and appointments efficiently. It provides features such as customer management, booking notifications, and calendar integration. However, a vulnerability has been identified in version 1.5.2 that exposes sensitive customer information due to improper handling of appointment hashes.
Vulnerability Detail
The vulnerability arises from the booking reschedule view at '/index.php/booking/reschedule/{appointment_hash}', where the entire customer record is embedded as inline JavaScript without authentication. This allows anyone with the 12-character appointment hash, which is easily accessible through emails and URLs, to retrieve sensitive customer information such as email, phone number, and address. The root cause is the lack of field whitelisting when fetching customer data, leading to over-disclosure of personal information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Operators can temporarily mitigate the issue by disabling the reschedule link in confirmation emails or disabling the public booking page entirely. However, these workarounds do not eliminate the root cause of the vulnerability.
Conclusion
The CVE-2026-52837 vulnerability in Easy!Appointments poses a significant risk by exposing sensitive customer information without authentication. It is crucial for users to update their software or apply the necessary code changes to protect customer data.
See every vulnerability recorded for alextselegidis/easyappointments →
FAQ
CVE-2026-52837 is a vulnerability in Easy!Appointments that allows unauthenticated access to sensitive customer information through the booking reschedule page.
Users' personal information, including email, phone number, and address, can be accessed by anyone with the appointment hash, leading to potential privacy breaches.
If you are using Easy!Appointments, ensure you update to the latest patched version or implement the suggested code changes to mitigate the vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for alextselegidis/easyappointments.
