Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, "Google::oauth" at "application/controllers/Google.php:278" stores its URL-supplied "provider_id" in the session, and "oauth_callback" saves the issued Google OAuth token against that row without checking the caller owns the provider. Any logged-in backend user (admin, provider, or secretary) rebinds a peer provider's Google sync to a Google account they control. The peer's appointments then sync into the attacker's calendar with each customer's name and email attached as attendee data. Version 1.6.0 patches the issue.