CVE-2026-55651 Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure
Authenticated users can obtain appointment hashes via excessive data exposure, allowing them to modify or delete other users' appointments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-55651?
CVE-2026-55651 is a high-severity vulnerability in alextselegidis easyappointments, published on 14 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover. Version 1.6.0 fixes the issue.
Weakness: CWE-200
Which versions are affected by CVE-2026-55651?
2 open source packages ship an affected version, including alextselegidis/easyappointments.
| Package | Affected | Fixed in |
|---|---|---|
alextselegidis/easyappointments Packagist | All versions | None |
alextselegidis/easyappointments Packagist | All versions | None |
How do I fix CVE-2026-55651?
No fix has been published for CVE-2026-55651 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-55651 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55651 exists.
Sources
Also known as GHSA-4vmm-5qvc-w5p7.