GHSA-xgr6-pqjv-3pf8: Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page

Summary The booking reschedule view at /index.php/booking/reschedule/{appointment_hash} (handled by Booking::index()) embeds the entire customer record as inline JavaScript (const vars = {... "customer_data": {...}, ...}) without authentication and without field whitelisting. Anyone in possession of the 12-character appointment_hash — which appears in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links — can read every column of that customer's row in the ea_users table. Verified against v1.5.2 with a Docker reproduction; a single anonymous GET to the reschedule URL returns 13 customer fields including email, phone, full address, custom fields, timezone, language, LDAP DN, and id_roles. Details Root cause application/controllers/Booking.php at line 184 reads the hash from the request, fetches the appointment, then loads the customer with Customers_model::find() — which returns the full row, no projection. It then passes the full record into script_vars(), which inlines it into the response HTML as a JavaScript constant. The reschedule UI itself uses only first_name and last_name; everything else is exposed for no functional reason. // application/controllers/Booking.php (v1.5.2) $appointment_hash = html_vars('appointment_hash'); // line 184 if (!empty($appointment_hash)) { $manage_mode = true; $results = $this->appointments_model->get(['hash' => $appointment_hash]); // ... $appointment = $results[0]; $provider = $this->providers_model->find($appointment['id_users_provider']); $customer = $this->customers_model->find($appointment['id_users_customer']); // ← full row, no projection $customer_token = md5(uniqid(mt_rand(), true)); $this->cache->save('customer-token-' . $customer_token, $customer['id'], 600); } script_vars([ // ... 'customer_data' => $customer, // ← all PII inlined in HTML 'customer_token' => $customer_token, ]); The URL pattern is in the CSRF exemption list (application/config/config.php, csrf_exclude_uris c