CVE-2026-52841
Summary
Google::oauth at application/controllers/Google.php:278 stores its URL-supplied provider_id in the session, and oauth_callback saves the issued Google OAuth token against that row without checking the caller owns the provider. Any logged-in backend user (admin, provider, or secretary) rebinds a peer provider's Google sync to a Google account they control. The peer's appointments then sync into the attacker's calendar with each customer's name and email attached as attendee data.
Preconditions
- Attacker holds a backend login on the target instance (admin, provider, or secretary). The customer role cannot log in.
- The instance has Google Calendar OAuth configured at application/config/google.php - i.e. any deployment that uses the Google sync feature at all.
- Default deployment per the project's own docker-compose.yml; no non-default flags required.
Details
// application/controllers/Google.php:278-289
public function oauth(string $provider_id): void
{
if (!$this->session->userdata('user_id')) {
show_error('Forbidden', 403);
}
// Store the provider id for use on the callback function.
session(['oauth_provider_id' => $provider_id]); // (*) attacker-chosen id stored unchecked
// Redirect browser to google user content page.
header('Location: ' . $this->google_sync->get_auth_url());
}
// application/controllers/Google.php:305-337
public function oauth_callback(): void
{
if (!session('user_id')) {
abort(403, 'Forbidden');
}
$code = request('code');
if (empty($code)) { response('Code authorization failed.'); return; }
$token = $this->google_sync->authenticate($code);
if (empty($token)) { response('Token authorization failed.'); return; }
$oauth_provider_id = session('oauth_provider_id');
if ($oauth_provider_id) {
$this->providers_model->set_setting($oauth_provider_id, 'google_sync', true); // (*)
$this->providers_model->set_setting($oauth_provider_id, 'google_token', json_encode($token)); // (*)
$this->providers_model->set_setting($oauth_provider_id,
⚡ Watch CVE-2026-52841
Get an email if CVE-2026-52841 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.13% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-52841)