CVE-2026-52839: Easy!Appointments Cross-Provider Appointment Injection Vulnerability
Summary
CVE-2026-52839: Easy!Appointments correctly filters provider-scoped appointments in the appointments/search response, proving that provider isolation is an intended security boundary. Affects alextselegidis/easyappointments versions < 1.6.0. Fixed in 1.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Easy!Appointments is an open-source appointment scheduling software designed for service providers such as clinics and salons. It allows users to manage appointments, services, and customer interactions efficiently. However, it has a vulnerability that allows authenticated providers to manipulate appointments across different provider accounts, undermining the intended security boundaries.
Vulnerability Detail
The vulnerability arises from inadequate checks in the appointments/store and appointments/update endpoints, which allow authenticated providers to inject appointments into other providers' schedules without proper authorization. Specifically, these endpoints do not verify that the id_users_provider submitted in the appointment data matches the current session's provider ID. This oversight can lead to unauthorized appointment creation and reassignment, causing confusion, double bookings, and disruption of scheduling integrity. The issue is exacerbated by a write-before-crash bug in the store method, where unauthorized appointments are committed to the database before an error occurs, making detection difficult.
How To Fix
Minimum fixed version
1.6.0
This is the first release that contains the fix.
composer require alextselegidis/easyappointments:1.6.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, providers should avoid using the store and update endpoints until the patch is applied. Additionally, implement strict access controls and monitor appointment changes to detect any unauthorized modifications.
Conclusion
CVE-2026-52839 represents a significant security risk for Easy!Appointments users, allowing unauthorized access to appointment management features. It is crucial to update to the patched version and implement the suggested code changes to safeguard against potential exploitation.
See every vulnerability recorded for alextselegidis/easyappointments →
FAQ
CVE-2026-52839 is a vulnerability in Easy!Appointments that allows authenticated providers to inject appointments into other providers' schedules due to inadequate authorization checks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to unauthorized appointment creation, reassignment, confusion among staff, double bookings, and disruption of scheduling integrity.
Update Easy!Appointments to version 1.6.0 or later, which includes the necessary security checks to prevent this vulnerability.
The CVSS score of this vulnerability is 3.3, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for alextselegidis/easyappointments.
