Is CVE-2026-55651 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55651 being exploited in the wild.

How severe is CVE-2026-55651?

High severity, with a CVSS score of 7.1, published 14 July 2026.

Which products and versions are affected?

Easy Appointments 1.5.2; alextselegidis/easyappointments (Packagist) = 1.5.2.

Is there a fix for CVE-2026-55651?

A patch was published on 2026-07-29: Release 1.6.0 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55651 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55651?

Check whether you run Easy Appointments or alextselegidis/easyappointments (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55651: Easy!Appointments excessive data exposure in customer search

CVE-2026-55651 · Severity: high · CVSS 7.1 · Published 2026-07-14

Easy!Appointments, an open-source appointment scheduling application, contains a security flaw that allows one service provider to view and take control of appointments belonging to others. By accessing a specific search feature, an authenticated user can obtain secret identifiers for appointments they do not own. This allows them to reschedule, modify, or delete those appointments, potentially leading to significant operational disruption and unauthorized access to customer scheduling data.

Technologies: Easy Appointments, alextselegidis/easyappointments (Packagist). Vendors: Easy Appointments, Packagist.

Quick answers

Is CVE-2026-55651 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55651 being exploited in the wild.
How severe is CVE-2026-55651?: High severity, with a CVSS score of 7.1, published 14 July 2026.
Which products and versions are affected?: Easy Appointments 1.5.2; alextselegidis/easyappointments (Packagist) = 1.5.2.
Is there a fix for CVE-2026-55651?: A patch was published on 2026-07-29: Release 1.6.0 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55651 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55651?: Check whether you run Easy Appointments or alextselegidis/easyappointments (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Excessive Data Exposure (CWE-200) vulnerability exists in the `/customers/search` endpoint of Easy!Appointments version 1.5.2. The endpoint fails to implement proper object-level authorization checks, returning sensitive appointment hashes for all customers in the search results regardless of the requesting user's permissions. An authenticated attacker can extract these hashes and use them with the `/calendar/reschedule/{hash}` endpoint to view, modify, or delete appointments belonging to other providers. This effectively allows for a full appointment takeover. The issue is addressed in version 1.6.0.

Affected products

alextselegidis Easy!Appointments 1.5.2

Identifiers

CVE-2026-55651
GHSA-4vmm-5qvc-w5p7

Timeline

2026-06-15: disclosed
2026-07-14: advisory: NVD publication date
2026-07-29: advisory: GitHub Advisory reviewed
2026-07-29: patched: Release 1.6.0 available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.