Easy!Appointments versions before 1.6.0 allow a logged‑in backend user to provide a CalDAV URL that is passed directly to a Guzzle REPORT request without validation of scheme or host. The call can reach RFC1918, loopback, or link‑local addresses on the deployment’s network. When the request fails, the exception propagates an upstream status code and about 120 bytes of the response body into the JSON message field, giving an attacker semi‑blind view of internal services.

The vulnerability affects the application Easy!Appointments, specifically any instance running a version earlier than 1.6.0, regardless of deployment size or environment.

The CVSS score of 2.7 indicates low severity, and the EPSS score of less than 1% suggests a very low probability of exploitation. The issue is not listed in CISA’s KEV catalog. Attacks require an authenticated backend user (admin, provider, or secretary) to trigger the vulnerable CalDAV connection test. An attacker could use this gather information that might be leveraged for further compromise. However, no direct code‑execution or privilege‑escalation capability is provided by the flaw alone.