DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-55651: CVE-2026-55651: Excessive Data Exposure and BOLA in Easy!Appointments Customer Search

#security #cve #cybersecurity

CVE-2026-55651: Excessive Data Exposure and BOLA in Easy!Appointments Customer Search

Vulnerability ID: CVE-2026-55651
CVSS Score: 7.1
Published: 2026-07-29

An Excessive Data Exposure vulnerability in Easy!Appointments v1.5.2 allows low-privileged administrative users, such as restricted Providers and Secretaries, to harvest unique, stateless appointment hashes belonging to other providers. These hashes act as capability tokens, granting full authorization to reschedule, take over, or delete appointments via stateless endpoints, resulting in a complete Broken Object Level Authorization (BOLA) scenario.

TL;DR

An authenticated low-privileged user (Provider or Secretary) in Easy!Appointments v1.5.2 can query the customer search endpoint to leak sensitive appointment hashes of other users, allowing subsequent unauthorized cancellation, rescheduling, or takeover of any appointment.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-200
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 7.1 (High)
  • EPSS Score: 0.00185 (0.185% probability)
  • Exploit Status: poc
  • CISA KEV Status: Not Listed

Affected Systems

  • Easy!Appointments v1.5.2 installations utilizing multi-provider or multi-secretary setups.
  • easyappointments: = 1.5.2 (Fixed in: 1.6.0)

Code Analysis

Commit: ebbe411

Fix customer search data leakage by introducing role-based appointment filtering in Customers controller.

Exploit Details

Mitigation Strategies

  • Upgrade Easy!Appointments to version 1.6.0 or later.
  • Manually apply server-side filtering to application/controllers/Customers.php.
  • Disable access to the customer search function for low-privileged accounts if the feature is not strictly required.
  • Implement stricter session verification on public modification endpoints.

Remediation Steps:

  1. Backup the Easy!Appointments database and application files.
  2. Download Easy!Appointments version 1.6.0 from the official release page.
  3. Replace the old application directory with the updated code.
  4. Verify the permissions in the Customers.php controller by performing a test search using a low-privileged provider account.

References

Read the full report for CVE-2026-55651 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)