{"uuid": "c6325e39-f3ab-4803-860c-cf115fb9f782", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52837", "type": "seen", "source": "https://gist.github.com/alon710/2d94cc50795411681f41b69ad6e69380", "content": "# CVE-2026-52837: CVE-2026-52837: Unauthenticated PII Leakage in Easy!Appointments Booking Reschedule Endpoint\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-52837\n\n## Summary\nAn unauthenticated Personally Identifiable Information (PII) disclosure vulnerability exists in Easy!Appointments versions up to and including 1.5.2. Requesting the booking reschedule endpoint with a valid appointment hash causes the system to embed the raw customer database record into the HTML response as inline JavaScript variables, exposing sensitive details. This includes email addresses, phone numbers, physical addresses, custom database metadata, and internal directory configurations such as LDAP DNs. The vulnerability has been resolved in version 1.6.0.\n\n## TL;DR\nUnauthenticated remote attackers can extract complete customer database records by accessing the booking reschedule endpoint with a valid 12-character appointment hash.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200, CWE-639\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **EPSS Score**: 0.00352 (Percentile: 27.89%)\n- **Impact**: Information Disclosure (PII Leakage)\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Easy!Appointments <= 1.5.2\n- **Easy!Appointments**: <= 1.5.2 (Fixed in: `1.6.0`)\n\n## Mitigation\n\n- Upgrade to Easy!Appointments version 1.6.0 or later\n- Manually apply array-filtering hotfix to the Booking controller\n- Enforce strict Referrer-Policy to prevent hash leakage\n\n**Remediation Steps:**\n1. Assess current Easy!Appointments version and back up the database and web root.\n2. Apply the official upgrade package to transition to version 1.6.0 or newer.\n3. Verify the patch by loading a reschedule URL and inspecting the rendered HTML source for the absence of raw 'customer_data' fields.\n4. Configure the web server (Nginx/Apache) to append 'Referrer-Policy: no-referrer' to outgoing HTTP headers.\n\n## References\n\n- [GitHub Security Advisory GHSA-xgr6-pqjv-3pf8](https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-xgr6-pqjv-3pf8)\n- [Fix Commit 40bb0b3](https://github.com/alextselegidis/easyappointments/commit/40bb0b31b531540bc9006efce4220eb0a437ed2b)\n- [Easy!Appointments 1.6.0 Release Notes](https://github.com/alextselegidis/easyappointments/releases/tag/1.6.0)\n- [NVD CVE-2026-52837 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-52837)\n- [CVE.org CVE-2026-52837 Record](https://www.cve.org/CVERecord?id=CVE-2026-52837)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-52837) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T04:31:31.123107Z"}