https://vulnerability.circl.lu/sightings/feed 2026-08-04T06:27:40.001952+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/56133f08-9d80-4f2b-bb31-628e7dc1eb63/export 2026-08-04T06:27:40.023749+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "56133f08-9d80-4f2b-bb31-628e7dc1eb63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55651", "type": "seen", "source": "https://gist.github.com/alon710/eef1157f11956461ac0859c3d9d6253b", "content": "# CVE-2026-55651: CVE-2026-55651: Excessive Data Exposure and BOLA in Easy!Appointments Customer Search\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55651\n\n## Summary\nAn Excessive Data Exposure vulnerability in Easy!Appointments v1.5.2 allows low-privileged administrative users, such as restricted Providers and Secretaries, to harvest unique, stateless appointment hashes belonging to other providers. These hashes act as capability tokens, granting full authorization to reschedule, take over, or delete appointments via stateless endpoints, resulting in a complete Broken Object Level Authorization (BOLA) scenario.\n\n## TL;DR\nAn authenticated low-privileged user (Provider or Secretary) in Easy!Appointments v1.5.2 can query the customer search endpoint to leak sensitive appointment hashes of other users, allowing subsequent unauthorized cancellation, rescheduling, or takeover of any appointment.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.1 (High)\n- **EPSS Score**: 0.00185 (0.185% probability)\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Easy!Appointments v1.5.2 installations utilizing multi-provider or multi-secretary setups.\n- **easyappointments**: = 1.5.2 (Fixed in: `1.6.0`)\n\n## Mitigation\n\n- Upgrade Easy!Appointments to version 1.6.0 or later.\n- Manually apply server-side filtering to application/controllers/Customers.php.\n- Disable access to the customer search function for low-privileged accounts if the feature is not strictly required.\n- Implement stricter session verification on public modification endpoints.\n\n**Remediation Steps:**\n1. Backup the Easy!Appointments database and application files.\n2. Download Easy!Appointments version 1.6.0 from the official release page.\n3. Replace the old application directory with the updated code.\n4. Verify the permissions in the Customers.php controller by performing a test search using a low-privileged provider account.\n\n## References\n\n- [CVE-2026-55651 Detail on NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-55651)\n- [GitHub Security Advisory GHSA-4vmm-5qvc-w5p7](https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-4vmm-5qvc-w5p7)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55651) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T07:31:43.768839Z"} 2026-07-30T07:31:43.768839+00:00 https://vulnerability.circl.lu/sighting/9de60ce1-3c2d-4aa2-a087-770184683257/export 2026-08-04T06:27:40.026260+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "9de60ce1-3c2d-4aa2-a087-770184683257", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55651", "type": "published-proof-of-concept", "source": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-4vmm-5qvc-w5p7", "content": "", "creation_timestamp": "2026-07-29T18:35:25.879822Z"} 2026-07-29T18:35:25.879822+00:00