Stored XSS in Easy!Appointments via Unauthenticated Customer Data Exposure

Executive Summary

CVE-2026-52837 is a vulnerability in the Easy!Appointments application (versions 1.5.2 and earlier). It allows unauthenticated disclosure of customer personally identifiable information (PII).

The vulnerability occurs on the booking reschedule page at `/index.php/booking/reschedule/{appointment_hash}`. The page embeds the entire customer record as inline JavaScript without requiring authentication or applying field whitelisting. This means anyone with access to the 12-character appointment hash can retrieve sensitive customer data.

The appointment hash is not a secret, as it appears in reschedule emails, confirmation page URLs, and operator-side calendar links. This increases the risk of exposure through side channels like email forwarding or browser history.

The issue stems from the `Booking::index()` function, which fetches the full customer record using `Customers_model::find()` and passes it directly to `script_vars()`. This exposes fields like email, phone, address, custom fields, timezone, language, LDAP DN, and roles, even though the reschedule UI only requires first and last names.

A proof-of-concept script demonstrates extracting 13 PII fields, including regulated data under laws like GDPR and HIPAA. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information) and CWE-639 (Authorization Bypass Through User-Controlled Key).

The suggested fix involves whitelisting only the required customer fields before inlining them into the response. Version 1.6.0 contains a patch for this issue.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability on your network or system, you can check for the exposure of customer data via the booking reschedule endpoint in Easy!Appointments versions 1.5.2 or earlier.

• Inspect network traffic or logs for requests to the vulnerable endpoint: `/index.php/booking/reschedule/{appointment_hash}`. The appointment hash is a 12-character string visible in reschedule emails, confirmation page URLs, or operator-side calendar links.
• Use a web vulnerability scanner or manual testing to send a GET request to the endpoint. For example, using `curl`: `curl http://your-easyappointments-instance/index.php/booking/reschedule/{appointment_hash}`. Replace `{appointment_hash}` with a valid hash from your system.
• Check the response for embedded JavaScript containing customer data. Look for a line like `const vars = {... "customer_data": {...}, ...}` in the HTML or JavaScript response. This indicates the vulnerability is present.
• Verify the version of Easy!Appointments installed. If it is 1.5.2 or earlier, the system is vulnerable. You can check the version in the application's configuration files or by reviewing the source code.

Additionally, monitor for unusual access patterns to the reschedule endpoint, as attackers may attempt to exploit this vulnerability by testing multiple appointment hashes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several ways if you are a user or administrator of the Easy!Appointments application:

• Exposure of sensitive personal data: An attacker with access to the appointment hash can retrieve your full customer record, including email, phone number, address, and other PII.
• Privacy violations: The disclosed data may include regulated information under laws like GDPR or HIPAA, leading to potential legal or compliance issues.
• Increased risk of phishing or identity theft: Attackers could use the exposed PII to craft targeted phishing attacks or attempt identity theft.
• Unauthorized access to appointment details: Since the appointment hash is visible in emails and URLs, attackers could exploit this to access or manipulate appointment-related information.

If you are an administrator, this vulnerability could also lead to reputational damage, loss of customer trust, and potential legal consequences if sensitive data is exposed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can significantly impact compliance with common standards and regulations in the following ways:

• GDPR (General Data Protection Regulation): The exposure of PII, such as email addresses, phone numbers, and addresses, violates GDPR principles of data minimization and confidentiality. Organizations may face fines or legal action if they fail to protect customer data adequately.
• HIPAA (Health Insurance Portability and Accountability Act): If the exposed data includes health-related information (e.g., appointment details for medical services), this could constitute a breach of HIPAA's Privacy Rule, leading to penalties and mandatory breach notifications.
• Other regional laws: Depending on the jurisdiction, similar data protection laws (e.g., CCPA in California) may also be violated, resulting in legal or financial consequences for organizations handling customer data.

The vulnerability is classified under CWE-200 (Exposure of Sensitive Information), which directly relates to the failure to protect regulated data. Organizations using affected versions of Easy!Appointments may need to report the incident to regulatory bodies and affected individuals, depending on the severity of the exposure.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade to Easy!Appointments version 1.6.0 or later, which contains the official patch for this vulnerability. This is the most effective long-term solution.
• If upgrading is not immediately possible, disable the reschedule functionality temporarily. This can be done by removing or commenting out the reschedule links in emails, confirmation pages, and operator-side calendar views to prevent access to the vulnerable endpoint.
• Restrict access to the `/index.php/booking/reschedule/{appointment_hash}` endpoint by implementing IP-based access controls or requiring authentication for this specific route. This is a temporary measure and may not fully mitigate the risk.
• Monitor and log access to the reschedule endpoint to detect any unauthorized attempts to exploit the vulnerability. Set up alerts for unusual activity, such as multiple requests to different appointment hashes.
• Review and limit the customer data stored in the `ea_users` table. Remove or anonymize sensitive fields that are not strictly necessary for the reschedule functionality, such as phone numbers, addresses, or custom fields.

For additional protection, consider implementing a web application firewall (WAF) rule to block requests to the vulnerable endpoint or to sanitize responses containing sensitive data.

Useful 0 Not Useful 0