# CVE-2026-52840: alextselegidis Easy!Appointments SSRF in CalDAV connection test

Source: https://junglewise.ai/threats/cve-2026-52840-alextselegidis-easy-appointments-ssrf-in-caldav-connection-test  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-52840 · Severity: low · CVSS 3.1 · Published 2026-07-14

Easy!Appointments, an open-source appointment scheduling application, contains a security flaw in its CalDAV synchronization feature. A logged-in user, such as a staff member or administrator, can trick the server into making requests to internal network resources that are normally protected from the outside world. This could allow an attacker to map out the internal network or access sensitive information from other internal services like databases or mail servers.

Technologies: [alextselegidis/easyappointments (Packagist)](https://junglewise.ai/threats/technologies/alextselegidis-easyappointments). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-52840 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52840 being exploited in the wild.

**How severe is CVE-2026-52840?** Low severity, with a CVSS score of 3.1, published 14 July 2026.

**Which products and versions are affected?** alextselegidis/easyappointments (Packagist) <= 1.5.2, ECOSYSTEM:introduced=0,last_affected=1.5.2.

**Is there a fix for CVE-2026-52840?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-52840 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-52840?** Check whether you run alextselegidis/easyappointments (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in `Caldav::connect_to_server` within `application/controllers/Caldav.php`. The application fails to validate the `caldav_url` parameter before passing it to a Guzzle HTTP client for a `REPORT` request. An authenticated backend user (admin, provider, or secretary) can provide arbitrary URLs, including loopback (127.0.0.1) and RFC1918 private addresses. The vulnerability is semi-blind; while the full response is not returned, the Guzzle exception handler reflects the upstream HTTP status code and approximately 120 bytes of the response body in the JSON error message. This allows for internal port scanning and service fingerprinting. As of the advisory date, no official patch is available.

## Affected products

- alextselegidis Easy!Appointments <= 1.5.2

## Identifiers

- CVE-2026-52840
- GHSA-pm5p-7w5h-jm5q

## Timeline

- 2026-06-15: disclosed
- 2026-07-29: advisory

## References

- [https://api.github.com/users/Dredsen](https://api.github.com/users/Dredsen)
- [https://github.com/Dredsen](https://github.com/Dredsen)
- [https://api.github.com/users/Dredsen/gists%7B/gist_id%7D](https://api.github.com/users/Dredsen/gists%7B/gist_id%7D)
- [https://api.github.com/users/Dredsen/repos](https://api.github.com/users/Dredsen/repos)
- [https://avatars.githubusercontent.com/u/24421368?v=4](https://avatars.githubusercontent.com/u/24421368?v=4)
- [https://api.github.com/users/Dredsen/events%7B/privacy%7D](https://api.github.com/users/Dredsen/events%7B/privacy%7D)

## Related threats

- [Easy!Appointments excessive data exposure in customer search](https://junglewise.ai/threats/cve-2026-55651-easy-appointments-excessive-data-exposure-in-customer-search)
- [Easy!Appointments authorization bypass in Google OAuth provider binding](https://junglewise.ai/threats/cve-2026-52841-easy-appointments-authorization-bypass-in-google-oauth-provider)
- [Easy!Appointments authorization bypass in appointment store and update](https://junglewise.ai/threats/cve-2026-52839-easy-appointments-authorization-bypass-in-appointment-store-and)
- [Easy!Appointments stored XSS in booking disabled message](https://junglewise.ai/threats/cve-2026-52838-easy-appointments-stored-xss-in-booking-disabled-message)
- [alextselegidis Easy!Appointments information disclosure in reschedule view](https://junglewise.ai/threats/cve-2026-52837-alextselegidis-easy-appointments-information-disclosure-in)