GHSA-8hm4-r66f-29wr: Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync

Summary Google::oauth at application/controllers/Google.php:278 stores its URL-supplied provider_id in the session, and oauth_callback saves the issued Google OAuth token against that row without checking the caller owns the provider. Any logged-in backend user (admin, provider, or secretary) rebinds a peer provider's Google sync to a Google account they control. The peer's appointments then sync into the attacker's calendar with each customer's name and email attached as attendee data. Preconditions - Attacker holds a backend login on the target instance (admin, provider, or secretary). The customer role cannot log in. - The instance has Google Calendar OAuth configured at application/config/google.php - i.e. any deployment that uses the Google sync feature at all. - Default deployment per the project's own docker-compose.yml; no non-default flags required. Details // application/controllers/Google.php:278-289 public function oauth(string $provider_id): void { if (!$this->session->userdata('user_id')) { show_error('Forbidden', 403); } // Store the provider id for use on the callback function. session(['oauth_provider_id' => $provider_id]); // (*) attacker-chosen id stored unchecked // Redirect browser to google user content page. header('Location: ' . $this->google_sync->get_auth_url()); } // application/controllers/Google.php:305-337 public function oauth_callback(): void { if (!session('user_id')) { abort(403, 'Forbidden'); } $code = request('code'); if (empty($code)) { response('Code authorization failed.'); return; } $token = $this->google_sync->authenticate($code); if (empty($token)) { response('Token authorization failed.'); return; } $oauth_provider_id = session('oauth_provider_id'); if ($oauth_provider_id) { $this->providers_model->set_setting($oauth_provider_id, 'google_sync', true); // (*) $this->providers_model->set_setting($oauth_provider_id, 'google_token', json_encode($token)); // (*) $this->providers_model->set_setting($oauth_provider_id,