{"uuid": "50ad1c76-019c-44d1-bceb-060cfcfdb131", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52841", "type": "seen", "source": "https://gist.github.com/alon710/555463e864b3e92acb0ee1bba5502d4f", "content": "# CVE-2026-52841: CVE-2026-52841: Authorization Bypass in Easy!Appointments Google OAuth Provider Binding\n\n> **CVSS Score:** 3.1\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-52841\n\n## Summary\nAn authorization bypass vulnerability exists in Easy!Appointments before version 1.6.0. The application fails to validate ownership of the provider ID during the Google OAuth synchronization process. This allows authenticated backend users to link their personal Google Calendars to peer providers, leading to unauthorized access to scheduled appointments and associated customer metadata.\n\n## TL;DR\nAn authorization bypass flaw in Easy!Appointments allows authenticated backend users to bind their personal Google OAuth token to other providers' profiles, syncing external scheduling metadata and customer PII directly to the attacker's calendar.\n\n## Technical Details\n\n- **CWE ID**: CWE-639\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 3.1 (Low)\n- **EPSS Score**: 0.00129\n- **CISA KEV Status**: Not Listed\n- **Exploit Status**: No public PoC\n- **Vulnerable Versions**: < 1.6.0\n\n## Affected Systems\n\n- Easy!Appointments self-hosted appointment scheduler\n- **Easy!Appointments**: < 1.6.0 (Fixed in: `1.6.0`)\n\n## Mitigation\n\n- Upgrade to Easy!Appointments version 1.6.0 or newer\n- Audit active Google Calendar configuration bindings in the application database\n- Monitor application logs for session state manipulation attempts\n\n**Remediation Steps:**\n1. Apply the software update to version 1.6.0 or newer on your production servers\n2. Verify that the Google.php controller includes the updated authorization check inside the oauth_callback method\n3. Query the ea_settings database table to identify duplicate or unexpected Google sync configurations\n4. Revoke any suspicious or duplicate Google OAuth synchronization tokens\n\n## References\n\n- [GitHub Security Advisory GHSA-8hm4-r66f-29wr](https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-8hm4-r66f-29wr)\n- [Easy!Appointments Patch Commit 4b2d245](https://github.com/alextselegidis/easyappointments/commit/4b2d245d2cd2058dc76e05f6eb65b26699268471)\n- [Easy!Appointments 1.6.0 Release Tag](https://github.com/alextselegidis/easyappointments/releases/tag/1.6.0)\n- [NVD - CVE-2026-52841 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-52841)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-52841) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T03:31:37.463951Z"}