CyberRota Analysis
AI-GeneratedEasy!Appointments version 1.5.2 contains an Excessive Data Exposure vulnerability in the customers search endpoint, allowing authenticated users to access appointment hashes of other users. This can lead to appointment takeover, enabling attackers to modify or delete appointments belonging to other providers. Organizations using this version should prioritize upgrading to version 1.6.0 to mitigate the risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover. Version 1.6.0 fixes the issue.