PatchSiren cyber security CVE debrief
CVE-2026-52837 alextselegidis CVE debrief
CVE-2026-52837 is a vulnerability in Easy!Appointments, a self-hosted appointment scheduler. Versions up to and including 1.5.2 embed the entire customer record as inline JavaScript without authentication or field whitelisting, allowing unauthorized access to customer data via a 12-character appointment hash. This issue affects users of Easy!Appointments who have not upgraded to version 1.6.0 or later.
- Vendor
- alextselegidis
- Product
- easyappointments
- CVSS
- MEDIUM 6.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-14
- Original CVE updated
- 2026-07-21
- Advisory published
- 2026-07-14
- Advisory updated
- 2026-07-21
Who should care
Users of Easy!Appointments versions up to 1.5.2, particularly those managing customer appointments, should be aware of this vulnerability and take steps to protect their customers' data by upgrading to version 1.6.0 or later and implementing additional security measures.
Technical summary
The booking reschedule view at `/index.php/booking/reschedule/{appointment_hash}` in Easy!Appointments versions up to 1.5.2 embeds the entire customer record as inline JavaScript without authentication or field whitelisting. This allows anyone with the 12-character `appointment_hash` to read every column of the corresponding customer's row in the `ea_users` table. The vulnerability is addressed in version 1.6.0.
Defensive priority
Medium
Recommended defensive actions
- Upgrade to version 1.6.0 or later
- Limit access to appointment hashes
- Monitor for suspicious activity
- Implement additional security measures to protect customer data
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
The CVE record was published on 2026-07-14T15:17:04.170Z and last modified on 2026-07-21T19:17:10.830Z. The NVD entry is currently Deferred. Evidence is limited to CVE and NVD details. Defenders should verify affected Easy!Appointments deployments and review customer data exposure.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-14T15:17:04.170Z and has not been modified since then. The NVD entry is currently Deferred.