CVE-2026-48077

Received Received - Intake

OpenReception Appointment Software Unauthorized Appointment Data Exposure

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at `/api/tenants/{id}/appointments/{appointmentId}` performs no authorization check before returning the appointment record. Any party who knows or obtains a valid appointment UUID receives the full row, including channel and agent IDs, time and timezone, status, and the AES-GCM ciphertext components (`encryptedPayload`, `iv`, `authTag`, `dataKey`). The same file's DELETE handler calls `checkPermission(locals, tenantId, true)` before allowing deletion. The intent is clear: appointment records are tenant-scoped and require authentication to access. The GET handler is missing the equivalent call. The middleware chain (`apiAuthHandle`, `authGuard`) does not compensate: API paths bypass `authGuard` entirely, and `apiAuthHandle` does not block requests to non-admin paths when no token is present. Version 1.1.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-48077

Affected Vendors & Products

Vendor	Product	Version / Range
openreception	appointment_booking_software	to 1.1.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is in OpenReception's appointment booking software before version 1.1.0. The GET endpoint for fetching appointment details lacks proper authorization checks. Any user with a valid appointment UUID can access sensitive data like agent IDs, timestamps, and encrypted appointment details without authentication.

Detection Guidance

Check if your OpenReception software version is below 1.1.0. Review logs for unauthorized access to /api/tenants/{id}/appointments/{appointmentId} endpoints. Look for requests without valid tokens accessing appointment data.

Impact Analysis

Attackers could exploit this to view or steal appointment data, including encrypted contents. While the data is encrypted, the exposure of metadata (like IDs and timestamps) could enable further attacks. The vulnerability also highlights inconsistent security controls since DELETE operations require authentication but GET does not.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal data. GDPR requires strict access controls for personal data, while HIPAA mandates safeguards for protected health information. The exposure of appointment metadata and encrypted data could lead to compliance violations and penalties.

Mitigation Strategies

Upgrade to OpenReception version 1.1.0 or later. Ensure all API endpoints enforce authentication checks. Review and restrict access to appointment UUIDs. Monitor for suspicious access patterns to the affected endpoints.

Hi! I’m here to help you understand CVE-2026-48077. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70