EUVD-2026-336514

fkie_cve-2026-52841

Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Google::oauth` at `application/controllers/Google.php:278` stores its URL-supplied `provider_id` in the session, and `oauth_callback` saves the issued Google OAuth token against that row without checking the caller owns the provider. Any logged-in backend user (admin, provider, or secretary) rebinds a peer provider's Google sync to a Google account they control. The peer's appointments then sync into the attacker's calendar with each customer's name and email attached as attendee data. Version 1.6.0 patches the issue.

GHSA-8hm4-r66f-29wr — Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's…

Affected: Packagist: alextselegidis/easyappointments

### Summary

`Google::oauth` at `application/controllers/Google.php:278` stores its URL-supplied `provider_id` in the session, and `oauth_callback` saves the issued Google OAuth token against that row without checking the caller owns the provider. Any logged-in backend user (admin, provider, or secretary) rebinds a peer provider's Google sync to a Google account they control. The peer's appointments then sync into the attacker's calendar with each customer's name and email attached as attendee data.

### Preconditions

- Attacker holds a backend login on the target instance (admin, provider, or secretary). The customer role cannot log in. - The instance has Google Calendar OAuth configured at `application/config/google.php` - i.e. any deployment that uses the Google sync feature at all. - Default deployment per the project's own `docker-compose.yml`; no non-default flags required.

### Details

```php // application/controllers/Google.php:278-289 public function oauth(string $provider_id): void { if (!$this->session->userdata('user_id')) { show_error('Forbidden', 403); }

// Store the provider id for use on the callback function. session(['oauth_provider_id' => $provider_id]); // (*) attacker-chosen id stored unchecked

// Redirect browser to google user content page. header('Location: ' . $this->google_sync->get_auth_url()); } ```

```php // application/controllers/Google.php:305-337 public function oauth_callback(): voi…

Most recent entries from all

EUVD-2026-336514

fkie_cve-2026-52841

GHSA-8hm4-r66f-29wr — Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's…