CVE-2026-52839: Easy!Appointments Auth Bypass Vulnerability

CVE-2026-52839 Overview

CVE-2026-52839 is an Insecure Direct Object Reference [CWE-639] vulnerability in Easy!Appointments, a self-hosted appointment scheduling application. Versions prior to 1.6.0 fail to enforce provider isolation on the appointments/store and appointments/update endpoints. An authenticated provider can inject appointments into another provider's schedule or reassign existing appointments to a foreign calendar by supplying an arbitrary id_users_provider value. The store path also commits the unauthorized row to the database before a downstream type error terminates the controller, so the write persists even when the client receives an error response. Version 1.6.0 patches the flaw.

Critical Impact
Authenticated providers can create or reassign appointments in the calendars of other providers, breaking scheduling integrity and tenant isolation.

Affected Products

Easy!Appointments versions prior to 1.6.0
appointments/store controller endpoint
appointments/update controller endpoint

Discovery Timeline

2026-07-14 - CVE-2026-52839 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-52839

Vulnerability Analysis

Easy!Appointments enforces provider isolation on the read path. The appointments/search response filters results by the caller's provider ID, confirming that per-provider scoping is an intended security boundary. The write paths do not honor this boundary. The appointments/store and appointments/update handlers verify generic appointment privileges but never confirm that the submitted id_users_provider matches the authenticated session's provider ID.

A logged-in provider can therefore submit a crafted request that references another provider's ID. The controller writes the appointment against the foreign calendar without rejecting the mismatched ownership field. Because the check occurs against the caller's role rather than the target object's owner, this is a classic authorization bypass tied to a user-controlled identifier.

The store handler amplifies the impact through a write-before-crash bug. The database insert executes before a later type error aborts the controller. The attacker receives an HTTP error response, but the unauthorized appointment row is already committed and visible on the victim provider's schedule.

Root Cause

The controllers trust the client-supplied id_users_provider field and skip verification that the value matches the session provider. Missing ownership validation on state-changing endpoints is the direct cause, mapped to [CWE-639] Authorization Bypass Through User-Controlled Key.

Attack Vector

An authenticated provider account is required. The attacker sends a POST request to appointments/store or appointments/update with id_users_provider set to a target provider's identifier. No user interaction is required, and the attack occurs over the network against the application's authenticated API surface.

The upstream patch is available in the Easy!Appointments GitHub commit history and the GHSA-w8xc-8g92-v77h advisory.

Detection Methods for CVE-2026-52839

Indicators of Compromise

Appointment rows whose id_users_provider value does not match the id_users_provider of the session that created or last modified them.
HTTP 500 or type-error responses from appointments/store immediately followed by a new appointment row in the database.
Providers reporting unfamiliar appointments appearing on their calendars without corresponding audit trail entries in their own session logs.

Detection Strategies

Correlate web server access logs for POST /appointments/store and POST /appointments/update with the authenticated user ID and compare against the id_users_provider field in the request body.
Alert on any request where the authenticated provider ID differs from the submitted id_users_provider value.
Baseline appointment creation patterns per provider and flag anomalies where one provider account writes to multiple provider calendars.

Monitoring Recommendations

Enable verbose application logging for the Appointments controller class and forward logs to a centralized platform for retention and query.
Track HTTP 4xx and 5xx responses from appointments/store paired with successful database inserts to detect the write-before-crash pattern.
Review database audit logs for INSERT and UPDATE operations against the appointments table that originate from unexpected provider sessions.

How to Mitigate CVE-2026-52839

Immediate Actions Required

Upgrade Easy!Appointments to version 1.6.0 or later, which enforces provider ownership checks on appointments/store and appointments/update.
Audit the appointments table for rows created or updated while the vulnerable versions were deployed and validate provider ownership against session logs.
Rotate provider account credentials if unauthorized cross-provider writes are identified.

Patch Information

The fix is included in Easy!Appointments 1.6.0. Reference the upstream security advisory GHSA-w8xc-8g92-v77h and the remediation commit for the exact changes applied to the appointment controllers.

Workarounds

Restrict access to the Easy!Appointments backend to trusted provider accounts only until the upgrade is applied.
Deploy a web application firewall rule that inspects POST requests to appointments/store and appointments/update and blocks requests where the id_users_provider field does not match the authenticated session's provider ID.
Temporarily disable provider self-service scheduling in multi-tenant deployments where cross-tenant writes would cause operational impact.

bash

# Upgrade to the patched release
git fetch --tags
git checkout 1.6.0
composer install --no-dev --optimize-autoloader
php index.php migrate