The root cause of this vulnerability is that Easy!Appointments allows an unauthenticated user to access the booking reschedule page and the application injects the entire customer record into the page as inline JavaScript without performing any authentication or field whitelisting, exposing every column in the ea_users table. This flaw is an example of information disclosure (CWE‑200) and a form of privilege escalation where a known identifier (the 12‑character appointment_hash) can be used to bypass authentication checks (CWE‑639). Consequently, any data stored for that customer, including highly sensitive personal information, can be read by anyone who obtains the hash.

The affected product is Easy!Appointments from the vendor alextselegidis. All releases up to and including version 1.5.2 are vulnerable. The vendor released a patch in version 1.6.0 that removes unauthenticated exposure on the booking reschedule endpoint.

The CVSS score of 6.9 classifies the flaw as medium severity, while an EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is possession of a valid 12‑character appointment_hash, which is embedded in reschedule emails, confirmation page URLs, and operator‑side calendar links. An attacker only needs this hash to read the full customer record; no credentials or elevated privileges are required.