Is CVE-2026-52841 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52841 being exploited in the wild.

How severe is CVE-2026-52841?

Low severity, with a CVSS score of 3.1, published 14 July 2026.

Which products and versions are affected?

alextselegidis/easyappointments (Packagist) <= 1.5.2, ECOSYSTEM:introduced=0,last_affected=1.5.2.

Is there a fix for CVE-2026-52841?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-52841 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-52841?

Check whether you run alextselegidis/easyappointments (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52841: Easy!Appointments authorization bypass in Google OAuth provider binding

Q: Is there a fix for CVE-2026-52841?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-52841 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-52841?

Check whether you run alextselegidis/easyappointments (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52841 · Severity: low · CVSS 3.1 · Published 2026-07-14

Easy!Appointments is an open-source appointment scheduling application. A security flaw allows any staff member (such as a secretary or provider) to hijack the Google Calendar synchronization of other staff members. By doing so, an attacker can view private customer details like names and emails, delete existing appointments, or block out time on a colleague's schedule, potentially disrupting business operations and compromising client privacy.

Technologies: alextselegidis/easyappointments (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-52841 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52841 being exploited in the wild.
How severe is CVE-2026-52841?: Low severity, with a CVSS score of 3.1, published 14 July 2026.
Which products and versions are affected?: alextselegidis/easyappointments (Packagist) <= 1.5.2, ECOSYSTEM:introduced=0,last_affected=1.5.2.
Is there a fix for CVE-2026-52841?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-52841 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-52841?: Check whether you run alextselegidis/easyappointments (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass exists in the `Google::oauth` and `oauth_callback` methods within `application/controllers/Google.php`. The `oauth` method accepts a user-supplied `provider_id` and stores it in the session without verifying if the authenticated user has permission to modify that specific provider's settings. During the subsequent OAuth callback, the application saves the resulting Google OAuth token to the `provider_id` stored in the session. An attacker with backend access (admin, provider, or secretary) can exploit this to bind their own Google account to a peer's profile. This allows the attacker to receive sync updates containing customer PII (name/email) and manipulate the victim's calendar via the synchronization loop. As of the advisory, no patch is specified, but the reporter suggests implementing the same permission checks used in other sync-management functions.

Affected products

alextselegidis Easy!Appointments <= 1.5.2

Identifiers

CVE-2026-52841
GHSA-8hm4-r66f-29wr

Timeline

2026-06-15: disclosed
2026-07-29: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.