DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-52837: CVE-2026-52837: Unauthenticated PII Leakage in Easy!Appointments Booking Reschedule Endpoint

#security #cve #cybersecurity

CVE-2026-52837: Unauthenticated PII Leakage in Easy!Appointments Booking Reschedule Endpoint

Vulnerability ID: CVE-2026-52837
CVSS Score: 6.9
Published: 2026-07-29

An unauthenticated Personally Identifiable Information (PII) disclosure vulnerability exists in Easy!Appointments versions up to and including 1.5.2. Requesting the booking reschedule endpoint with a valid appointment hash causes the system to embed the raw customer database record into the HTML response as inline JavaScript variables, exposing sensitive details. This includes email addresses, phone numbers, physical addresses, custom database metadata, and internal directory configurations such as LDAP DNs. The vulnerability has been resolved in version 1.6.0.

TL;DR

Unauthenticated remote attackers can extract complete customer database records by accessing the booking reschedule endpoint with a valid 12-character appointment hash.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-200, CWE-639
  • Attack Vector: Network (Unauthenticated)
  • CVSS v4.0 Score: 6.9 (Medium)
  • EPSS Score: 0.00352 (Percentile: 27.89%)
  • Impact: Information Disclosure (PII Leakage)
  • Exploit Status: Proof-of-Concept
  • CISA KEV Status: Not Listed

Affected Systems

  • Easy!Appointments <= 1.5.2
  • Easy!Appointments: <= 1.5.2 (Fixed in: 1.6.0)

Code Analysis

Commit: 40bb0b3

Filter customer array in the reschedule controller to prevent complete PII serialization

Exploit Details

  • GitHub Security Advisory: Official disclosure containing technical details of the unauthenticated customer data exposure.

Mitigation Strategies

  • Upgrade to Easy!Appointments version 1.6.0 or later
  • Manually apply array-filtering hotfix to the Booking controller
  • Enforce strict Referrer-Policy to prevent hash leakage

Remediation Steps:

  1. Assess current Easy!Appointments version and back up the database and web root.
  2. Apply the official upgrade package to transition to version 1.6.0 or newer.
  3. Verify the patch by loading a reschedule URL and inspecting the rendered HTML source for the absence of raw 'customer_data' fields.
  4. Configure the web server (Nginx/Apache) to append 'Referrer-Policy: no-referrer' to outgoing HTTP headers.

References

Read the full report for CVE-2026-52837 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)