Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments

Vulnerability

Easy!Appointments versions prior to 1.4.3 contain an information disclosure vulnerability that exposes private personal information to unauthorized actors. The issue is present in the self-hosted open source appointment scheduler. Affected versions include all releases before 1.4.3, which was published on 2022-03-08 [3]. The specific vulnerable endpoint or mechanism is not detailed in the available references, but the official CVE description confirms exposure of private personal information [1].

Exploitation

An attacker can exploit this vulnerability without requiring authentication, as the exposure occurs to “unauthorized actors.” The exact network position needed (e.g., local or remote) is not specified, but the vulnerability is remotely exploitable based on the description “Exposure of Private Personal Information to an Unauthorized Actor” [1]. No user interaction or special privileges are required. The exploitation steps are not publicly detailed, but the Packet Storm advisory [1] may contain proof-of-concept details [1].

Impact

Successful exploitation leads to the disclosure of private personal information, which may include customer names, email addresses, phone numbers, appointment details, or other sensitive data managed by the application. This constitutes a confidentiality breach, potentially exposing the operator’s business or its customers to privacy violations and further targeted attacks [1][4].

Mitigation

The vendor released version 1.4.3 on 2022-03-08, which fixes the vulnerability [3]. Users must update to 1.4.3 or later immediately. There is no workaround disclosed in the references. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog as of the last available check. No additional mitigations, such as configuration changes, are provided [2][4].