CVE-2026-52839

{
  "id": "CVE-2026-52839",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-14T16:17:00.540",
  "lastModified": "2026-10-24T21:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the `appointments/search` response, proving that provider isolation is an intended security boundary. However, the direct mutation endpoints `appointments/store` and `appointments/update` only check generic appointment privileges and never verify that the submitted `id_users_provider` belongs to the current session. A normal authenticated provider can inject new appointments into another provider's schedule via `store`, or reassign existing appointments into a foreign provider's calendar via `update`. The `store` path contains an additional write-before-crash bug: the unauthorized row is committed to the database before the controller crashes on a type error, so the attacker receives an error response while the foreign appointment is already persisted. Version 1.6.0 patches the issue."
    },
    {
      "lang": "es",
      "value": "Easy!Appointments es un programador de citas autohospedado. Las versiones anteriores a la 1.6.0 filtran correctamente las citas con ámbito de proveedor en la respuesta de appointments/search, lo que demuestra que el aislamiento de proveedores es un límite de seguridad intencionado. Sin embargo, los puntos finales de mutación directa appointments/store y appointments/update solo verifican privilegios genéricos de citas y nunca comprueban que el id_users_provider enviado pertenezca a la sesión actual. Un proveedor autenticado normal puede inyectar nuevas citas en la agenda de otro proveedor a través de store, o reasignar citas existentes al calendario de un proveedor externo a través de update. La ruta store contiene un error adicional de escritura antes de la caída (write-before-crash): la fila no autorizada se confirma en la base de datos antes de que el controlador falle por un error de tipo, por lo que el atacante recibe una respuesta de error mientras la cita externa ya está persistida. La versión 1.6.0 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "alextselegidis",
          "product": "easyappointments",
          "versions": [
            {
              "version": "< 1.6.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 3.3,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 0.7,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-15T14:48:44.724792Z",
          "id": "CVE-2026-52839",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/alextselegidis/easyappointments/commit/725eafa647308846ce887657db12771a829e42ef",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-w8xc-8g92-v77h",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-w8xc-8g92-v77h",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}