SSRF via Unvalidated Caldav URL in Easy!Appointments

CVE-2026-52840 is a Server-Side Request Forgery (SSRF) vulnerability in Easy!Appointments, a self-hosted appointment scheduler. The vulnerability exists in versions prior to 1.6.0.

The flaw occurs in the CalDAV connection test functionality, specifically in the `Caldav::connect_to_server` method at `application/controllers/Caldav.php:60`. The application fails to validate the scheme or host of the `caldav_url` parameter provided in a request before passing it to a Guzzle HTTP client for a REPORT call.

This lack of validation allows authenticated backend users (admins, providers, or secretaries) to send requests to internal network hosts, including loopback addresses (e.g., 127.0.0.1), RFC1918 private IP ranges (e.g., 192.168.x.x), and link-local addresses. The SSRF is semi-blind because the application returns the upstream HTTP status code and approximately 120 bytes of the response body in the JSON error message when the request fails.

• The vulnerability affects Easy!Appointments versions 1.5.2 and earlier.
• Exploitation requires a valid backend login, but non-admin users can bypass certain checks by supplying their own `provider_id`.
• The default Docker deployment of Easy!Appointments may expose internal services like MySQL, Mailpit, and phpMyAdmin to this SSRF attack.

A patch for this vulnerability was introduced in version 1.6.0.

To detect the CVE-2026-52840 vulnerability on your network or system, you can monitor for unusual outbound HTTP requests originating from the Easy!Appointments application. Since the vulnerability allows authenticated backend users to send requests to internal or restricted network hosts, you can look for signs of SSRF exploitation.

• Check application logs for unexpected outbound requests to loopback addresses (e.g., 127.0.0.1), RFC1918 private IPs (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), or link-local addresses (e.g., 169.254.0.0/16).
• Use network monitoring tools like Wireshark or tcpdump to capture traffic from the Easy!Appointments server. Filter for HTTP/HTTPS requests to internal or unusual destinations. Example tcpdump command: tcpdump -i eth0 -s 0 -A 'tcp port 80 or tcp port 443 and host not <your_public_ip>'.
• Inspect the Easy!Appointments application logs for error messages containing upstream HTTP status codes or response body snippets (up to ~120 bytes) from internal services. These may appear in JSON error messages when the SSRF request fails.
• Verify if the `caldav_url` parameter in the CalDAV connection test functionality is being used to target internal hosts. This can be done by reviewing logs or intercepting requests using a proxy tool like Burp Suite.
• Look for signs of port scanning or service fingerprinting, such as repeated failed connection attempts to different internal IP addresses or ports. This may indicate an attacker is probing for accessible services.

If you are using an affected version of Easy!Appointments (1.5.2 or earlier), this vulnerability could have several impacts on your system and network.

• Unauthorized access to internal services: An attacker with backend access (admin, provider, or secretary) could use this vulnerability to send requests to internal network services that are not normally exposed to the internet. This includes databases, administrative interfaces, or other internal applications.
• Information disclosure: The semi-blind nature of the SSRF allows attackers to receive HTTP status codes and up to ~120 bytes of response body from internal services. This could leak sensitive information such as error messages, service banners, or partial data.
• Network reconnaissance: Attackers can use the vulnerability to perform port scanning or service fingerprinting on internal hosts. This helps them map out your internal network and identify potential targets for further attacks.
• Exposure of internal services in Docker deployments: If you are using the default Docker deployment, internal services like MySQL, Mailpit, and phpMyAdmin may be accessible to the SSRF attack, increasing the risk of unauthorized access or data leakage.

While the CVSS score of 2.7 (Low) suggests the primary risk is information disclosure rather than direct data modification or service disruption, the impact could still be significant depending on the sensitivity of your internal services and data.

This vulnerability could impact compliance with several common standards and regulations, depending on the nature of the data and services exposed in your environment.

• GDPR (General Data Protection Regulation): If the SSRF vulnerability leads to unauthorized access to personal data of EU citizens, it could be considered a data breach under GDPR. Organizations are required to implement appropriate technical measures to protect personal data, and failing to patch or mitigate this vulnerability could be seen as a violation of these requirements. Additionally, if the vulnerability results in the disclosure of personal data, you may be required to report the breach to authorities and affected individuals within 72 hours.
• HIPAA (Health Insurance Portability and Accountability Act): For organizations handling protected health information (PHI) in the U.S., this vulnerability could lead to a HIPAA violation if it results in unauthorized access to PHI. HIPAA requires covered entities to implement safeguards to protect the confidentiality, integrity, and availability of PHI. An SSRF attack that exposes PHI could be considered a breach, triggering notification requirements and potential penalties.
• PCI DSS (Payment Card Industry Data Security Standard): If your Easy!Appointments instance is part of a system that processes, stores, or transmits payment card data, this vulnerability could put you at risk of non-compliance with PCI DSS. The standard requires regular vulnerability management and network segmentation to protect cardholder data. An SSRF attack that accesses internal systems handling payment data could violate these requirements.
• ISO 27001: This international standard for information security management requires organizations to identify and address vulnerabilities in a timely manner. Failure to patch or mitigate this SSRF vulnerability could be seen as a gap in your vulnerability management process, potentially leading to non-compliance during audits.

To maintain compliance, it is important to apply the patch (version 1.6.0 or later) or implement mitigations such as rejecting non-HTTP/HTTPS schemes and private IP addresses. Additionally, you should review your internal network segmentation to limit the exposure of sensitive services.

To mitigate CVE-2026-52840, follow these immediate steps to reduce the risk of exploitation:

• Upgrade to Easy!Appointments version 1.6.0 or later, which contains a patch for the vulnerability. The patch includes hardcoded SSRF protection and removes the vulnerable configuration option.
• If upgrading is not immediately possible, apply network-level restrictions to limit outbound requests from the Easy!Appointments server. Use a firewall or network security group to block outbound traffic to loopback, RFC1918, and link-local addresses.
• Disable the CalDAV synchronization feature if it is not required for your deployment. This removes the attack surface entirely.
• Implement strict input validation for the `caldav_url` parameter. Ensure that only HTTP/HTTPS schemes are allowed and reject any URLs pointing to private or internal IP addresses.
• Monitor and audit backend user accounts (admins, providers, secretaries) to ensure only trusted individuals have access. Remove or disable unnecessary accounts.
• Isolate the Easy!Appointments server from other internal services, especially in Docker deployments. Place it in a separate network segment to limit access to MySQL, Mailpit, phpMyAdmin, and other services.
• Enable detailed logging for outbound requests and regularly review logs for signs of SSRF attempts or unusual activity.