CVE-2026-52841: Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Google::oauth` at `application/controllers/Google.php:278` stores its URL-supplied `provider_

lowCVSS 3.1CVE-2026-52841

Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, Google::oauth at application/controllers/Google.php:278 stores its URL-supplied provider_id in the session, and oauth_callback saves the issued Google OAuth token against that row without checking the caller owns the provider. Any logged-in backend user (admin, provider, or secretary) rebinds a peer provider's Google sync to a Google account they control. The peer's appointments then sync into the attacker's calendar with each customer's name and email attached as attendee data. Version 1.6.0 patches the issue.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: low — CVSS 3.1
Published: 2026-07-14
Last updated: 2026-07-14
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-52841

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-528410.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-52841	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

lowGHSA-8hm4-r66f-29wr: Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend…ghsa

Recent advisories for Easy!Appointments is a

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-14226: The Easy Appointments WordPress plugin through 3.12.26 does not require a sufficient capabilit…nvd · 2026-07-30
mediumCVE-2026-14223: The Easy Appointments WordPress plugin through 3.12.26 does not verify ownership or capability…nvd · 2026-07-30
lowCVE-2026-14222: The Easy Appointments WordPress plugin through 3.12.26 does not perform any capability or nonc…nvd · 2026-07-30
lowCVE-2026-14221: The Easy Appointments WordPress plugin through 3.12.26 does not perform capability checks in s…nvd · 2026-07-30
lowCVE-2026-14188: The Easy Appointments WordPress plugin through 3.12.26 does not perform a per-request capabili…nvd · 2026-07-30
lowGHSA-996f-334j-67g7: Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — S…ghsa · 2026-07-29