DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-52839: CVE-2026-52839: Cross-Provider Appointment Injection and Authorization Bypass in Easy!Appointments

#security #cve #cybersecurity

CVE-2026-52839: Cross-Provider Appointment Injection and Authorization Bypass in Easy!Appointments

Vulnerability ID: CVE-2026-52839
CVSS Score: 3.3
Published: 2026-07-29

An authorization bypass and logical 'write-before-crash' vulnerability in Easy!Appointments versions prior to 1.6.0 allows authenticated users with the 'Provider' role to inject unauthorized bookings into foreign providers' schedules or reassign existing appointments via parameter manipulation on the 'store' and 'update' endpoints.

TL;DR

Authenticated providers can inject or reassign appointments into schedules of other providers due to missing session-boundary validation on mutation endpoints, compounded by a write-before-crash logic flaw.

Technical Details

  • CWE ID: CWE-639
  • Attack Vector: Network
  • CVSS v3.1 Score: 3.3 (Low)
  • Exploit Status: None (No active public exploits)
  • CISA KEV Status: Not Listed
  • Affected Functions: appointments/store, appointments/update

Affected Systems

  • Easy!Appointments
  • Easy!Appointments: < 1.6.0 (Fixed in: 1.6.0)

Code Analysis

Commit: 725eafa

Enforce session-based provider-scoped access and fix the type crash in the find method within the Appointments controller.

Mitigation Strategies

  • Upgrade to Easy!Appointments version 1.6.0 or higher to apply official fixes.
  • Apply manual session validation controls to the store and update methods in application/controllers/Appointments.php.
  • Perform scheduled database integrity reviews to identify unauthorized appointment reassignments.

Remediation Steps:

  1. Identify all deployment instances running Easy!Appointments versions older than 1.6.0.
  2. Back up the active database and configuration files.
  3. Download and install Easy!Appointments version 1.6.0 from the official release page.
  4. If manual patching is required, insert session role-slug verification checks into the store() and update() functions.
  5. Verify the patch by attempting to submit an appointment containing a foreign provider ID using a low-privilege provider account.

References

Read the full report for CVE-2026-52839 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)