alextselegidis easyappointments up to 1.5.x Caldav Caldav.php connect_to_server caldav_url server-side request forgery

Summaryinfo

A vulnerability identified as problematic has been detected in alextselegidis easyappointments up to 1.5.x. Affected by this vulnerability is the function connect_to_server of the file application/controllers/Caldav.php of the component Caldav. Performing a manipulation of the argument caldav_url results in server-side request forgery. This vulnerability is known as CVE-2026-52840. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in alextselegidis easyappointments up to 1.5.x. This affects the function connect_to_server of the file application/controllers/Caldav.php of the component Caldav. The manipulation of the argument caldav_url with an unknown input leads to a server-side request forgery vulnerability. CWE is classifying the issue as CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This is going to have an impact on confidentiality. The summary by CVE is:

Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Caldav::connect_to_server` at `application/controllers/Caldav.php:60` hands the request's `caldav_url` to a Guzzle `REPORT` call without scheme or host validation. A logged-in backend user (admin, provider, or secretary) reaches loopback, RFC1918, and link-local hosts on the deployment's network. The Guzzle exception path returns the upstream status code plus ~120 bytes of response body in the JSON `message` field (`Caldav.php:74-78`), so the SSRF is semi-blind. Version 1.6.0 contains a patch.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-52840 since 06/08/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. The exploitation requires an enhanced level of successful authentication. Technical details are known, but no exploit is available.

By approaching the search of inurl:application/controllers/Caldav.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.6.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Appointment Software

Vendor

• alextselegidis

Name

• easyappointments

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5

Website

• Product: https://github.com/alextselegidis/easyappointments/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion