{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.5.2"}],"component":"alextselegidis/easyappointments","cve_ids":["CVE-2026-52841"],"ecosystem":"Packagist","epss":0.00206,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-8hm4-r66f-29wr","id":"tcs_01M5KEZ31CK5P85WT86G7P7Q58","modified_at":"2026-07-29T16:45:35.660043076Z","published_at":"2026-07-29T16:29:26Z","references":["https://osv.dev/vulnerability/GHSA-8hm4-r66f-29wr","https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-8hm4-r66f-29wr","https://nvd.nist.gov/vuln/detail/CVE-2026-52841","https://github.com/alextselegidis/easyappointments/commit/4b2d245d2cd2058dc76e05f6eb65b26699268471","https://github.com/alextselegidis/easyappointments","https://github.com/alextselegidis/easyappointments/releases/tag/1.6.0"],"severity":{"label":"low","score":3.1},"sources":[{"source":"osv","source_id":"GHSA-8hm4-r66f-29wr","url":"https://osv.dev/vulnerability/GHSA-8hm4-r66f-29wr"}],"summary":"Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync"}