Server-side request forgery in alextselegidis easyappointments
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.
Summary
Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Caldav::connect_to_server` at `application/controllers/Caldav.php:60` hands the request's `caldav_url` to a Guzzle `REPORT` call without scheme or host validation. A logged-in backend user (admin, provider, or secretary) reaches loopback, RFC1918, and link-local hosts on the deployment's network. The Guzzle exception path returns the upstream status code plus ~120 bytes of response body in the JSON `message` field (`Caldav.php:74-78`), so the SSRF is semi-blind. Version 1.6.0 contains a patch.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| alextselegidis | easyappointments | before 1.6.0 | 1.6.0 | Patch available | CNA |
| — | alextselegidis/easyappointments (Packagist) | up to 1.5.2 | — | No fix listed | GHSA-pm5p-7w5h-jm5q |
- easyappointments Vendoralextselegidis Affected before 1.6.0 Fixed in 1.6.0 Patch available CNA
- alextselegidis/easyappointments (Packagist) Vendor— Affected up to 1.5.2 Fixed in — No fix listed GHSA-pm5p-7w5h-jm5q
Remediation
- Fix · CNA easyappointments (alextselegidis) Fixed in 1.6.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-52840
- 2026-10-03 Alias added: GHSA-pm5p-7w5h-jm5q
References
Other 7
- https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-pm5p-7w5h-jm5q
- https://github.com/alextselegidis/easyappointments/commit/6eb9336a91cfb276379506625e81f5bd9ed3a536
- https://github.com/alextselegidis/easyappointments/commit/2da2baed18ec32ad7916e507815709c8f010d510
- https://github.com/alextselegidis/easyappointments/commit/4abb10545d83ac1a57d03f6502376ee67696ea7c
- https://github.com/alextselegidis/easyappointments/commit/6b34b78c47790dfd1dec27cf62926db51be276e9
- https://github.com/alextselegidis/easyappointments
- https://github.com/alextselegidis/easyappointments/releases/tag/1.6.0
More alextselegidis vulnerabilities
- TI-2023-01200 Use of Hard-coded Credentials in alextselegidis/easyappointments CVSS 3.1CRITICAL 9.8
- TI-2026-70736 Easy!Appointments authorization bypass lets attackers modify bookings CVSS 4.0HIGH 8.8
- TI-2024-37956 An issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate… CVSS 3.1CRITICAL 9.8
- TI-2026-19023 CSRF Protection Bypass: Sensitive endpoints accept GET requests, enabling admin account takeover CVSS 4.0HIGH 7.4
- TI-2025-32119 alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection… CVSS 3.1HIGH 8.1
- TI-2023-01980 Session Fixation in alextselegidis/easyappointments CVSS 3.1HIGH 8.8
Sources
- CVE-2026-52840 · CVE Program
- CVE-2026-52840 · NVD
- FIRST EPSS
- GHSA-pm5p-7w5h-jm5q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences