Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page

The booking reschedule view at /index.php/booking/reschedule/appointmenthash handled by Booking::index embeds the entire customer record as inline JavaScript const vars = ... "customerdata": ..., ... without authentication and without field whitelisting. Anyone in possession of the 12-character...