OAuth Token Rebind in Easy!Appointments

Executive Summary

CVE-2026-52841 is an authorization bypass vulnerability in the Easy!Appointments application, affecting versions prior to 1.6.0. The issue occurs in the Google OAuth provider binding mechanism.

The vulnerability allows any logged-in backend user (admin, provider, or secretary) to rebind a peer provider's Google Calendar sync to their own Google account. This happens because the application stores a URL-supplied provider_id in the session without verifying ownership. When the OAuth callback saves the issued Google OAuth token, it does so without checking if the caller owns the provider account.

As a result, an attacker can initiate an OAuth flow for a victim provider's ID, authorize their own Google account, and then have the victim's appointments sync into the attacker's Google Calendar. This exposes customer data, including names and emails, as attendee information.

• The vulnerability stems from missing permission checks in the `oauth` and `oauth_callback` functions in `Google.php`.
• Other sync-related functions like `select_google_calendar` and `disable_provider_sync` enforce proper authorization, but these checks were not applied to the vulnerable functions.

The issue was patched in version 1.6.0 by adding proper authorization checks to ensure only admins or the provider themselves can initiate the rebinding process.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if your Easy!Appointments instance is running a version prior to 1.6.0, as the vulnerability affects versions 1.5.2 and earlier. You can verify the installed version by checking the application's source code or configuration files.

To detect potential exploitation, monitor for unusual Google OAuth callback activity or unexpected changes in provider Google Calendar sync settings. Specifically, look for:

• Logs showing OAuth callbacks for provider IDs that do not match the logged-in user's ID.
• Changes in the `google_sync`, `google_token`, or `google_calendar` settings for providers where the modifying user is not the owner or an admin.

Commands or steps to assist detection:

• Check the Easy!Appointments version by reviewing the `VERSION` file or application metadata in the installation directory.
• Review web server logs for requests to `/google/oauth_callback` with unusual `provider_id` parameters.
• Inspect the database for discrepancies in the `google_token` or `google_sync` fields across provider accounts, particularly if tokens are associated with unexpected Google accounts.
• Monitor for unexpected Google Calendar sync activity, such as appointments appearing in an attacker's calendar with customer data as attendees.

Useful 0 Not Useful 0

Impact Analysis

If you are using an affected version of Easy!Appointments (1.5.2 or earlier), this vulnerability could impact you in several ways:

• Confidentiality loss: An attacker with backend access could gain access to sensitive customer data, including names and email addresses, by syncing your appointments to their own Google Calendar.
• Integrity loss: The attacker could delete or modify your appointments by creating or removing events in their own Google Calendar, which would then sync back to your schedule.
• Schedule disruption: Your appointment schedule could be altered or disrupted, leading to missed appointments or incorrect bookings.

To exploit this vulnerability, an attacker would need:

• A valid backend login (admin, provider, or secretary) on your Easy!Appointments instance.
• Google OAuth configured for the Google Calendar sync feature in your instance.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could have significant implications for compliance with data protection regulations like GDPR and HIPAA, depending on the nature of the data exposed and the jurisdiction of the affected organization.

• GDPR (General Data Protection Regulation): If the exposed customer data includes personal information of EU residents, this vulnerability could lead to a breach of GDPR. The regulation requires organizations to implement appropriate technical and organizational measures to protect personal data. Failure to do so could result in fines of up to 4% of global annual revenue or €20 million, whichever is higher. Additionally, organizations must report certain types of data breaches to the relevant supervisory authority within 72 hours of becoming aware of the breach.
• HIPAA (Health Insurance Portability and Accountability Act): If the Easy!Appointments instance is used in a healthcare setting in the United States and the exposed data includes protected health information (PHI), this vulnerability could constitute a HIPAA breach. Covered entities and business associates must implement safeguards to protect PHI and report breaches affecting 500 or more individuals to the Department of Health and Human Services (HHS) and the media. Failure to comply with HIPAA can result in fines ranging from $100 to $50,000 per violation, with a maximum penalty of $1.5 million per year for each violation.

In both cases, the vulnerability could lead to unauthorized access to sensitive data, which may trigger mandatory breach notifications and potential penalties. Organizations should assess the risk and take appropriate steps to mitigate the vulnerability, such as upgrading to the patched version of Easy!Appointments.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate steps to mitigate this vulnerability include:

• Upgrade to Easy!Appointments version 1.6.0 or later, which contains the patch for this vulnerability. The fix ensures proper authorization checks are enforced in the `oauth_callback` function.
• If upgrading is not immediately possible, apply the patch manually by modifying the `Google.php` file to include the same provider ownership and admin permission checks used in other sync-related functions. Specifically, ensure the `oauth_callback` function validates the `oauth_provider_id` and `user_id` from the session and checks for proper privileges before saving OAuth settings.
• Restrict backend access to trusted users only, as exploitation requires a valid backend login (admin, provider, or secretary).
• Disable Google Calendar sync for providers if it is not critical to operations, reducing the attack surface.
• Monitor for unauthorized changes to provider Google OAuth settings, such as unexpected `google_token` or `google_sync` updates in the database.
• Review appointment logs and Google Calendar sync activity for signs of unauthorized access or manipulation.

Useful 0 Not Useful 0