{"uuid": "e6eea675-8680-4734-b931-a86ec16cfd31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52840", "type": "seen", "source": "https://gist.github.com/alon710/5f2d10f3a54edb2e4c4f46ec9659b74e", "content": "# CVE-2026-52840: CVE-2026-52840: Server-Side Request Forgery in Easy!Appointments CalDAV Connector\n\n> **CVSS Score:** 2.7\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-52840\n\n## Summary\nEasy!Appointments prior to version 1.6.0 is vulnerable to Server-Side Request Forgery (SSRF) within its CalDAV integration module. The system handles user-supplied URLs in the connection test endpoint without verifying host constraints or network schemes, allowing authenticated backend users to probe internal infrastructure.\n\n## TL;DR\nAn authenticated SSRF vulnerability in Easy!Appointments prior to 1.6.0 allows backend users to probe internal networks and access loopback and RFC1918 addresses via unvalidated CalDAV connection test requests.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 2.7\n- **EPSS Score**: 0.00186 (Percentile: 8.49%)\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Easy!Appointments scheduling platform\n- **easyappointments**: < 1.6.0 (Fixed in: `1.6.0`)\n\n## Mitigation\n\n- Upgrade Easy!Appointments to version 1.6.0 or higher.\n- Enforce network segmentation and egress filtering rules to prevent the application container from connecting to local and private IP addresses.\n- Audit existing backend accounts to ensure only trusted users hold administrative, provider, or secretary permissions.\n\n**Remediation Steps:**\n1. Download the Easy!Appointments 1.6.0 release package.\n2. Apply the database migrations and update the application files, ensuring the patched `application/libraries/Caldav_sync.php` is deployed.\n3. Verify that the `ENABLE_CALDAV_SSRF_CHECK` parameter or any equivalent toggles are removed from the configurations to maintain secure-by-default logic.\n4. Test the CalDAV connection interface with a loopback address to verify that host validation successfully blocks the request.\n\n## References\n\n- [GHSA-pm5p-7w5h-jm5q Advisory Details](https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-pm5p-7w5h-jm5q)\n- [NVD - CVE-2026-52840 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-52840)\n- [CVE.org CVE-2026-52840 Record](https://www.cve.org/CVERecord?id=CVE-2026-52840)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-52840) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T06:31:29.627132Z"}