Vulnerability · Published Jul 14, 2026 · Assigned by GitHub_M

CVE-2026-55651Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

High 7.1

In plain English

A high-severity information exposure in easyappointments from alextselegidis. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 86.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover. Version 1.6.0 fixes the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	alextselegidis/easyappointments	no fix listed	GHSA-4vmm-5qvc-w5p7

Affected products (as reported)

Vendor	Product	Versions
alextselegidis	easyappointments	= 1.5.2

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

References

https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-4vmm-5qvc-w5p7 x_refsource_CONFIRM