Information Exposure Affecting alextselegidis/easyappointments package, versions <1.6.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-ALEXTSELEGIDISEASYAPPOINTMENTS-17972362
- published14 Jul 2026
- disclosed14 Jul 2026
- creditUnknown
Introduced: 14 Jul 2026
NewCVE-2026-52837 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade alextselegidis/easyappointments to version 1.6.0 or higher.
Overview
alextselegidis/easyappointments is a powerful Open Source Appointment Scheduler that can be installed on your server.
Affected versions of this package are vulnerable to Information Exposure via the Booking::index process. An attacker can access sensitive customer information by obtaining the 12-character appointment_hash, which is exposed in plain text in reschedule emails, confirmation page URLs, and operator-side calendar links.