https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T19:29:53.205832+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-342440 EUVD-2026-342440 2026-10-05T19:29:53.255252+00:00 EUVD-2026-342440 https://cve.radiocsirt.org/vuln/fkie_cve-2026-52837 fkie_cve-2026-52837 2026-10-05T19:29:53.255289+00:00

Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the entire customer record as inline JavaScript (`const vars = {... "customer_data": {...}, ...}`) without authentication and without field whitelisting. Anyone in possession of the 12-character `appointment_hash` — which appears in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links — can read every column of that customer's row in the `ea_users` table. Version 1.6.0 contains a patch.

 https://cve.radiocsirt.org/vuln/ghsa-xgr6-pqjv-3pf8 GHSA-xgr6-pqjv-3pf8 — Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page 2026-10-05T19:29:53.255329+00:00

Affected: Packagist: alextselegidis/easyappointments

## Summary

The booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` (handled by `Booking::index()`) embeds the **entire customer record** as inline JavaScript (`const vars = {... "customer_data": {...}, ...}`) without authentication and without field whitelisting. Anyone in possession of the 12-character `appointment_hash` — which appears in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links — can read every column of that customer's row in the `ea_users` table.

Verified against v1.5.2 with a Docker reproduction; a single anonymous GET to the reschedule URL returns 13 customer fields including email, phone, full address, custom fields, timezone, language, LDAP DN, and `id_roles`.

## Details

### Root cause

`application/controllers/Booking.php` at line 184 reads the hash from the request, fetches the appointment, then loads the customer with `Customers_model::find()` — which returns the full row, no projection. It then passes the full record into `script_vars()`, which inlines it into the response HTML as a JavaScript constant. The reschedule UI itself uses only `first_name` and `last_name`; everything else is exposed for no functional reason.

```php // application/controllers/Booking.php (v1.5.2) $appointment_hash = html_vars('appointment_hash'); // line 184 if (!empty($appointment_hash)) { $manage_mode = true; $results = $this->appointments_model->get(['hash' => $appointment_hash]); //…