DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-52841: CVE-2026-52841: Authorization Bypass in Easy!Appointments Google OAuth Provider Binding

#security #cve #cybersecurity

CVE-2026-52841: Authorization Bypass in Easy!Appointments Google OAuth Provider Binding

Vulnerability ID: CVE-2026-52841
CVSS Score: 3.1
Published: 2026-07-29

An authorization bypass vulnerability exists in Easy!Appointments before version 1.6.0. The application fails to validate ownership of the provider ID during the Google OAuth synchronization process. This allows authenticated backend users to link their personal Google Calendars to peer providers, leading to unauthorized access to scheduled appointments and associated customer metadata.

TL;DR

An authorization bypass flaw in Easy!Appointments allows authenticated backend users to bind their personal Google OAuth token to other providers' profiles, syncing external scheduling metadata and customer PII directly to the attacker's calendar.

Technical Details

  • CWE ID: CWE-639
  • Attack Vector: Network
  • CVSS v3.1 Score: 3.1 (Low)
  • EPSS Score: 0.00129
  • CISA KEV Status: Not Listed
  • Exploit Status: No public PoC
  • Vulnerable Versions: < 1.6.0

Affected Systems

  • Easy!Appointments self-hosted appointment scheduler
  • Easy!Appointments: < 1.6.0 (Fixed in: 1.6.0)

Code Analysis

Commit: 4b2d245

Fix Google OAuth callback permission bypass by validating user privileges before updating provider settings

Mitigation Strategies

  • Upgrade to Easy!Appointments version 1.6.0 or newer
  • Audit active Google Calendar configuration bindings in the application database
  • Monitor application logs for session state manipulation attempts

Remediation Steps:

  1. Apply the software update to version 1.6.0 or newer on your production servers
  2. Verify that the Google.php controller includes the updated authorization check inside the oauth_callback method
  3. Query the ea_settings database table to identify duplicate or unexpected Google sync configurations
  4. Revoke any suspicious or duplicate Google OAuth synchronization tokens

References

Read the full report for CVE-2026-52841 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)