CVE-2026-55651

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-55651

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55651.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-55651

Aliases

GHSA-4vmm-5qvc-w5p7

Published

2026-07-14T15:31:51.028Z

Modified

2026-07-16T03:31:07.604274455Z

Severity

7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N CVSS Calculator

Summary

Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

Details

Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover. Version 1.6.0 fixes the issue.

Database specific

{
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55651.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/alextselegidis/easyappointments

Affected ranges

Type

GIT

Repo

https://github.com/alextselegidis/easyappointments

Events

Introduced

48d32686b0f40fc782c2bdf1bde4baafa4dbeea4

Last affected

48d32686b0f40fc782c2bdf1bde4baafa4dbeea4

Database specific

{
    "extracted_events": [
        {
            "introduced": "= 1.5.2"
        },
        {
            "last_affected": "= 1.5.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*

1.5.2

= 1.*

= 1.5.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55651.json"