{"vulnerability": "CVE-2026-52839", "sightings": [{"uuid": "78487193-8817-45ed-bfe3-f4ad74156389", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52839", "type": "seen", "source": "https://gist.github.com/alon710/5694b6f230218930632a6e462097e637", "content": "# CVE-2026-52839: CVE-2026-52839: Cross-Provider Appointment Injection and Authorization Bypass in Easy!Appointments\n\n> **CVSS Score:** 3.3\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-52839\n\n## Summary\nAn authorization bypass and logical 'write-before-crash' vulnerability in Easy!Appointments versions prior to 1.6.0 allows authenticated users with the 'Provider' role to inject unauthorized bookings into foreign providers' schedules or reassign existing appointments via parameter manipulation on the 'store' and 'update' endpoints.\n\n## TL;DR\nAuthenticated providers can inject or reassign appointments into schedules of other providers due to missing session-boundary validation on mutation endpoints, compounded by a write-before-crash logic flaw.\n\n## Technical Details\n\n- **CWE ID**: CWE-639\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 3.3 (Low)\n- **Exploit Status**: None (No active public exploits)\n- **CISA KEV Status**: Not Listed\n- **Affected Functions**: appointments/store, appointments/update\n\n## Affected Systems\n\n- Easy!Appointments\n- **Easy!Appointments**: < 1.6.0 (Fixed in: `1.6.0`)\n\n## Mitigation\n\n- Upgrade to Easy!Appointments version 1.6.0 or higher to apply official fixes.\n- Apply manual session validation controls to the store and update methods in application/controllers/Appointments.php.\n- Perform scheduled database integrity reviews to identify unauthorized appointment reassignments.\n\n**Remediation Steps:**\n1. Identify all deployment instances running Easy!Appointments versions older than 1.6.0.\n2. Back up the active database and configuration files.\n3. Download and install Easy!Appointments version 1.6.0 from the official release page.\n4. If manual patching is required, insert session role-slug verification checks into the store() and update() functions.\n5. Verify the patch by attempting to submit an appointment containing a foreign provider ID using a low-privilege provider account.\n\n## References\n\n- [GitHub Security Advisory GHSA-w8xc-8g92-v77h](https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-w8xc-8g92-v77h)\n- [NVD CVE-2026-52839 Record](https://nvd.nist.gov/vuln/detail/CVE-2026-52839)\n- [Easy!Appointments Version 1.6.0 Release Tag](https://github.com/alextselegidis/easyappointments/releases/tag/1.6.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-52839) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T05:31:24.691808Z"}, {"uuid": "89451881-a58c-45f5-8527-a319984798ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-52839", "type": "published-proof-of-concept", "source": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-w8xc-8g92-v77h", "content": "", "creation_timestamp": "2026-07-29T18:35:21.013812Z"}]}