Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

3.1 · CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

EPSS

• CVE-2026-52841: 0.21% estimated exploitation activity in the next 30 days; percentile 10.71 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary Google::oauth at application/controllers/Google.php:278 stores its URL-supplied providerid in the session, and oauthcallback saves the issued Google OAuth token against that row without checking the caller owns the provider. Any logged-in backend user (admin, provider, or secretary) rebinds a peer provider's Google sync to a Google account they control. The peer's appointments then sync into the attacker's calendar with each customer's name and email attached as attendee data. Preconditions - Attacker holds a backend login on the target instance (admin, provider, or secretary). The customer role cannot log in. - The instance has Google Calendar OAuth configured at application/config/google.php - i.e. any deployment that uses the Google sync feature at all. - Default deployment per the project's own docker-compose.yml; no non-default flags required. Details The same controller already carries the right gate on every other sync-management entry. selectgooglecalendar at…

Published by the source

29 Jul 2026, 16:29 UTC

Last modified by the source

29 Jul 2026, 16:45 UTC

Source last checked

26 Oct 2026, 14:50 UTC

1. Revision 2 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-8hm4-r66f-29wr

2. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-8hm4-r66f-29wr

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-52841

Advisory: Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync
IDs: CVE-2026-52841, GHSA-8hm4-r66f-29wr
Record: https://patchnext.com/advisories/cve-2026-52841 (revision 2, source checked 26 Oct 2026, 14:50 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Low (CVSS 3.1)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor response not established. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist alextselegidis/easyappointments: affected <= 1.5.2

## Suggested inspection (read-only)
- Packagist alextselegidis/easyappointments: check the installed version with your package manager.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on alextselegidis/easyappointments.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-8hm4-r66f-29wr (OSV record GHSA-8hm4-r66f-29wr lists affected ranges: Packagist alextselegidis/easyappointments >=0 <=1.5.2)
- Verified: https://github.com/advisories/GHSA-8hm4-r66f-29wr (GitHub-reviewed advisory GHSA-8hm4-r66f-29wr lists affected ranges: Packagist alextselegidis/easyappointments >=0 <=1.5.2)

Commands are suggestions: review each one before running it.