CVE-2026-55651 | Easy!Appointments is a self hosted appointment scheduler. In… | CVSS 7.1 HIGH

Description

Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover. Version 1.6.0 fixes the issue.

Metadata

CVE ID: CVE-2026-55651
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-16 23:52 UTC
Published: 2026-07-14 15:31 UTC
Last updated: 2026-07-14 16:00 UTC
Primary CWE: CWE-200
CWE-200: Exposure of Sensitive Information to an Unauthorize…
Vendor / Product: alextselegidis / easyappointments
Sources: cve.org · NVD

Severity & Metrics

7.1 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
alextselegidis	easyappointments	—	= 1.5.2

Weakness (CWE)

CWE	Source	Description
CWE-200	cna	CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.1	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

References (1)

https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-4vmm-5qvc-w5p7 https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-4vmm-5qvc-w5p7