Vulnerability-Lookup

GHSA-4VMM-5QVC-W5P7

Vulnerability from github – Published: 2026-07-29 16:22 – Updated: 2026-07-29 16:22

Summary

Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

Details

Summary

An Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover.

Details

The customers search endpoint exposes excessive information, including appointment hashes, to any authenticated user without proper authorization checks. These hashes uniquely identify appointments that do not belong to the searching user.

By reusing the obtained hashes, an attacker can interact with appointment management endpoints, allowing the modification or deletion of third-party appointments.

The lack of object-level authorization controls leads to an Appointments Takeover, impacting data confidentiality and integrity.

Impact

This vulnerability allows an authenticated user to take control of appointments belonging to other users. By obtaining and reusing the exposed hashes, an attacker can view, modify, or delete appointments of other providers, compromising data integrity and confidentiality. This may result in unauthorized appointment cancellations or modifications, operational disruption of the service.

PoC

Let's start by viewing an appointment with the provider “Jane Doe.”

Now, with the provider “test test” (another provider), let's send the request to /customers/search, where we can verify that the customer “Joe Shmoe” is on the list. This makes it possible to extract the hash of the appointment associated with the user Jane Doe, because the response is returning excessive data.

With this hash, we then go to the endpoint /calendar/reschedule/{hash} with the provider “test test,” where we can check some information about the appointment.

By changing the provider to “test test,” it is possible to change the appointment provider.

By saving, we can verify that the appointment is now in the “test test” provider, thus disappearing from the “John Doe” provider calendar.

Provider "test test" Calendar:

Provider "John Doe" Calendar:

5.1. Since we have takeover the appointment, it is possible to cancel/delete it.

Recommendation

When making the POST request to the /customers/search endpoint, only return appointments that belong to the provider sending the request. This way, the provider does not have access to the random hash and cannot perform the takeover.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "alextselegidis/easyappointments"
      },
      "versions": [
        "1.5.2"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55651"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-29T16:22:17Z",
    "nvd_published_at": "2026-07-14T16:17:00Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nAn Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users.\nUsing these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover.\n\n### Details\nThe customers search endpoint exposes excessive information, including appointment hashes, to any authenticated user without proper authorization checks.\nThese hashes uniquely identify appointments that do not belong to the searching user.\n\nBy reusing the obtained hashes, an attacker can interact with appointment management endpoints, allowing the modification or deletion of third-party appointments.\n\nThe lack of object-level authorization controls leads to an Appointments Takeover, impacting data confidentiality and integrity.\n\n### Impact\nThis vulnerability allows an authenticated user to take control of appointments belonging to other users. By obtaining and reusing the exposed hashes, an attacker can view, modify, or delete appointments of other providers, compromising data integrity and confidentiality. This may result in unauthorized appointment cancellations or modifications, operational disruption of the service.\n\n### PoC\n1. Let\u0027s start by viewing an appointment with the provider \u201cJane Doe.\u201d\n\n\u003cimg width=\"1912\" height=\"880\" alt=\"image\" src=\"https://github.com/user-attachments/assets/57bc0094-6e7f-4ccc-bde4-5604acd1debd\" /\u003e\n\n2. Now, with the provider \u201ctest test\u201d (another provider), let\u0027s send the request to /customers/search, where we can verify that the customer \u201cJoe Shmoe\u201d is on the list. This makes it possible to extract the hash of the appointment associated with the user Jane Doe, because the response is returning excessive data.\n\n\u003cimg width=\"579\" height=\"647\" alt=\"image\" src=\"https://github.com/user-attachments/assets/67897f21-d5a6-4edc-bed7-75c23465290b\" /\u003e\n\n3. With this hash, we then go to the endpoint /calendar/reschedule/{hash} with the provider \u201ctest test,\u201d where we can check some information about the appointment.\n\n\u003cimg width=\"1486\" height=\"917\" alt=\"image\" src=\"https://github.com/user-attachments/assets/29b1c20c-e2a8-483e-bd4d-749fb5de497f\" /\u003e\n\n4. By changing the provider to \u201ctest test,\u201d it is possible to change the appointment provider.\n\n\u003cimg width=\"966\" height=\"982\" alt=\"image\" src=\"https://github.com/user-attachments/assets/cfa17cb2-12ac-4034-aae2-1a626d4d0f9c\" /\u003e\n\n5. By saving, we can verify that the appointment is now in the \u201ctest test\u201d provider, thus disappearing from the \u201cJohn Doe\u201d provider calendar.\n\nProvider \"test test\" Calendar:\n\n\u003cimg width=\"1916\" height=\"879\" alt=\"image\" src=\"https://github.com/user-attachments/assets/77b9e11a-860f-4c08-847e-fa95c064710d\" /\u003e\n\nProvider \"John Doe\" Calendar:\n\n\u003cimg width=\"1917\" height=\"880\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d39566f5-a58c-4337-a781-0886faa83c12\" /\u003e\n\n5.1. Since we have takeover the appointment, it is possible to cancel/delete it.\n\n\u003cimg width=\"1486\" height=\"736\" alt=\"image\" src=\"https://github.com/user-attachments/assets/2a87b9d0-1726-4fdc-af72-7ae9e20cc050\" /\u003e\n\n\u003cimg width=\"290\" height=\"867\" alt=\"image\" src=\"https://github.com/user-attachments/assets/815b1df6-dfd4-437a-a2bd-e9b61832d5b0\" /\u003e\n\n### Recommendation\nWhen making the POST request to the /customers/search endpoint, only return appointments that belong to the provider sending the request. This way, the provider does not have access to the random hash and cannot perform the takeover.",
  "id": "GHSA-4vmm-5qvc-w5p7",
  "modified": "2026-07-29T16:22:17Z",
  "published": "2026-07-29T16:22:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-4vmm-5qvc-w5p7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55651"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alextselegidis/easyappointments/commit/ebbe41130dafa58b0716426c56c8cfd4c22dbceb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/alextselegidis/easyappointments"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alextselegidis/easyappointments/releases/tag/1.6.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure"
}

CVE-2026-55651 (GCVE-0-2026-55651)

Vulnerability from cvelistv5 – Published: 2026-07-14 15:31 – Updated: 2026-07-14 16:00

Title

Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

Summary

Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover. Version 1.6.0 fixes the issue.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/alextselegidis/easyappointment…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
alextselegidis	easyappointments	Affected: = 1.5.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55651",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T15:59:40.381297Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T16:00:49.009Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-4vmm-5qvc-w5p7"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "easyappointments",
          "vendor": "alextselegidis",
          "versions": [
            {
              "status": "affected",
              "version": "= 1.5.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users.\nUsing these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover. Version 1.6.0 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T15:31:51.028Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-4vmm-5qvc-w5p7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-4vmm-5qvc-w5p7"
        }
      ],
      "source": {
        "advisory": "GHSA-4vmm-5qvc-w5p7",
        "discovery": "UNKNOWN"
      },
      "title": "Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55651",
    "datePublished": "2026-07-14T15:31:51.028Z",
    "dateReserved": "2026-06-16T23:52:12.059Z",
    "dateUpdated": "2026-07-14T16:00:49.009Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

GHSA-4VMM-5QVC-W5P7

Summary

Details

Impact

PoC

Recommendation

CVE-2026-55651 (GCVE-0-2026-55651)

Tags

Sightings

Nomenclature