CVE-2026-52840
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
SSRF vulnerability in Easy!Appointments allows authenticated backend users to access loopback, RFC1918, and link-local hosts on the deployment network. Lack of scheme and host validation in the `caldav_url` parameter enables attackers to send REPORT requests to arbitrary addresses, with partial response disclosure in JSON messages.
Risk Assessment
Attackers can scan internal networks, access sensitive services (e.g., databases, APIs), and potentially pivot to other systems. Semi-blind SSRF with partial response disclosure increases data leakage risk while making detection harder.
Recommendation
Upgrade Easy!Appointments to version 1.6.0 or later immediately. If upgrade is not possible, restrict backend access to trusted users and apply firewall rules blocking RFC1918 traffic from the application.
Original NVD description (English source)
Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Caldav::connect_to_server` at `application/controllers/Caldav.php:60` hands the request's `caldav_url` to a Guzzle `REPORT` call without scheme or host validation. A logged-in backend user (admin, provider, or secretary) reaches loopback, RFC1918, and link-local hosts on the deployment's network. The Guzzle exception path returns the upstream status code plus ~120 bytes of response body in the JSON `message` field (`Caldav.php:74-78`), so the SSRF is semi-blind. Version 1.6.0 contains a patch.