CVE-2026-52837
Summary
The booking reschedule view at /index.php/booking/reschedule/{appointment_hash} (handled by Booking::index()) embeds the entire customer record as inline JavaScript (const vars = {... "customer_data": {...}, ...}) without authentication and without field whitelisting. Anyone in possession of the 12-character appointment_hash — which appears in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links — can read every column of that customer's row in the ea_users table.
Verified against v1.5.2 with a Docker reproduction; a single anonymous GET to the reschedule URL returns 13 customer fields including email, phone, full address, custom fields, timezone, language, LDAP DN, and id_roles.
Details
Root cause
application/controllers/Booking.php at line 184 reads the hash from the request, fetches the appointment, then loads the customer with Customers_model::find() — which returns the full row, no projection. It then passes the full record into script_vars(), which inlines it into the response HTML as a JavaScript constant. The reschedule UI itself uses only first_name and last_name; everything else is exposed for no functional reason.
// application/controllers/Booking.php (v1.5.2)
$appointment_hash = html_vars('appointment_hash'); // line 184
if (!empty($appointment_hash)) {
$manage_mode = true;
$results = $this->appointments_model->get(['hash' => $appointment_hash]);
// ...
$appointment = $results[0];
$provider = $this->providers_model->find($appointment['id_users_provider']);
$customer = $this->customers_model->find($appointment['id_users_customer']); // ← full row, no projection
$customer_token = md5(uniqid(mt_rand(), true));
$this->cache->save('customer-token-' . $customer_token, $customer['id'], 600);
}
script_vars([
// ...
'customer_data' => $customer, // ← all PII inlined in HTML
'customer_token' => $customer_token,
]);
The URL pattern is in the CSRF exemption list (application/config/config.php, csrf_exclude_uris c
⚡ Watch CVE-2026-52837
Get an email if CVE-2026-52837 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-52837)