CVE-2026-52841: Easy!Appointments Google OAuth Provider Authorization Bypass Vulnerability
Summary
CVE-2026-52841: Google::oauth at application/controllers/Google.php:278 stores its URL-supplied provider_id in the session, and oauth_callback saves the issued Google OAuth token against that row without checking the caller owns the pro... Affects alextselegidis/easyappointments versions < 1.5.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Easy!Appointments is an open-source appointment scheduling software that allows users to manage appointments, services, and providers. It integrates with Google Calendar for synchronization of appointments. The software is designed to facilitate scheduling for various types of users, including administrators, providers, and secretaries. However, a critical vulnerability exists in the Google OAuth provider binding, which allows unauthorized users to rebind a peer provider's Google sync, leading to potential data breaches.
Vulnerability Detail
The vulnerability arises from the oauth method in the Google controller, where the provider_id is stored in the session without proper ownership verification. This allows any logged-in backend user (admin, provider, or secretary) to bind their Google account to another provider's Google sync. As a result, the attacker can access and manipulate the victim's appointments, syncing them to their own Google Calendar, which compromises the confidentiality and integrity of the victim's data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict access to the Google OAuth functionality to only trusted users until the patch is applied. This can be done by modifying user roles and permissions in the application settings.
Conclusion
The CVE-2026-52841 vulnerability in Easy!Appointments poses a significant risk to user data integrity and confidentiality. It is crucial for users to update their installations to the patched version and implement the suggested permission checks to mitigate this risk.
See every vulnerability recorded for alextselegidis/easyappointments →
FAQ
CVE-2026-52841 is a vulnerability in Easy!Appointments that allows unauthorized users to rebind a peer provider's Google sync, potentially exposing sensitive appointment data.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring installation.
The vulnerability can lead to unauthorized access to appointment data, allowing attackers to view, modify, or delete appointments from a victim's calendar.
Yes, a patched version of Easy!Appointments is available. Updating to this version will resolve the vulnerability.
The CVSS score of this vulnerability is 3.1, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for alextselegidis/easyappointments.
