DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-52840: CVE-2026-52840: Server-Side Request Forgery in Easy!Appointments CalDAV Connector

#security #cve #cybersecurity

CVE-2026-52840: Server-Side Request Forgery in Easy!Appointments CalDAV Connector

Vulnerability ID: CVE-2026-52840
CVSS Score: 2.7
Published: 2026-07-29

Easy!Appointments prior to version 1.6.0 is vulnerable to Server-Side Request Forgery (SSRF) within its CalDAV integration module. The system handles user-supplied URLs in the connection test endpoint without verifying host constraints or network schemes, allowing authenticated backend users to probe internal infrastructure.

TL;DR

An authenticated SSRF vulnerability in Easy!Appointments prior to 1.6.0 allows backend users to probe internal networks and access loopback and RFC1918 addresses via unvalidated CalDAV connection test requests.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-918
  • Attack Vector: Network
  • CVSS v3.1 Score: 2.7
  • EPSS Score: 0.00186 (Percentile: 8.49%)
  • Exploit Status: poc
  • CISA KEV Status: Not Listed

Affected Systems

  • Easy!Appointments scheduling platform
  • easyappointments: < 1.6.0 (Fixed in: 1.6.0)

Code Analysis

Commit: 4abb105

Implement CalDAV URL validation checks and resolve host IPs to prevent SSRF against restricted ranges.

Commit: 6b34b78

Introduce configuration support for private CalDAV hosts.

Commit: 2da2bae

Explicitly allow local Docker CalDAV (baikal) setups and move SSRF logic configuration to controller instantiation parameters.

Commit: 6eb9336

Hardcode the SSRF toggle within the library definition to secure control pathways.

Mitigation Strategies

  • Upgrade Easy!Appointments to version 1.6.0 or higher.
  • Enforce network segmentation and egress filtering rules to prevent the application container from connecting to local and private IP addresses.
  • Audit existing backend accounts to ensure only trusted users hold administrative, provider, or secretary permissions.

Remediation Steps:

  1. Download the Easy!Appointments 1.6.0 release package.
  2. Apply the database migrations and update the application files, ensuring the patched application/libraries/Caldav_sync.php is deployed.
  3. Verify that the ENABLE_CALDAV_SSRF_CHECK parameter or any equivalent toggles are removed from the configurations to maintain secure-by-default logic.
  4. Test the CalDAV connection interface with a loopback address to verify that host validation successfully blocks the request.

References

Read the full report for CVE-2026-52840 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)