Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page

The booking reschedule view at /index.php/booking/reschedule/appointmenthash handled by Booking::index embeds the entire customer record as inline JavaScript const vars = ... "customerdata": ..., ... without authentication and without field whitelisting. Anyone in possession of the 12-character...

CVE-2026-52837

Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at "/index.php/booking/reschedule/appointmenthash" handled by "Booking::index" embeds the entire customer record as inline JavaScript "const vars = ... "customerdata": ...,...