CVE-2026-48078

Received Received - Intake

Unauthenticated Information Disclosure in OpenReception Appointment Software

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticated `/api/tenants/{id}/schedule` endpoint returns every non-archived channel for a tenant regardless of the channel's `isPublic` flag. Channels marked `isPublic = false` are intended to be invisible to public callers; the dashboard creates them deliberately to hide internal-only services from the patient booking UI. The schedule endpoint ignores the flag entirely and discloses channel names, descriptions, IDs, agent associations, pause status, confirmation requirements, and computed slot availability for the requested date range. The asymmetry between `addAppointmentToTunnel` (which enforces `eq(channel.isPublic, true)`) and the schedule endpoint (which does not) confirms the design intent: private channels exist as a real access boundary in the booking flow, just not in the schedule disclosure. Version 1.0.5 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-48078

Affected Vendors & Products

Vendor	Product	Version / Range
openreception	appointment_booking_software	to 1.0.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability affects OpenReception's appointment booking software before version 1.0.5. An unauthenticated endpoint `/api/tenants/{id}/schedule` exposes internal-only channels marked as non-public (`isPublic = false`) by revealing their names, descriptions, IDs, agent details, pause status, and slot availability. The software intended these channels to be hidden from public users, but the endpoint ignores the `isPublic` flag.

Detection Guidance

Check if the unauthenticated /api/tenants/{id}/schedule endpoint is accessible and returns channels with isPublic=false. Use curl to query the endpoint for different tenant IDs and inspect the response for private channel details like names, IDs, or descriptions.

Impact Analysis

Attackers could discover internal-only services, agent assignments, and availability details for a tenant. This may enable targeted phishing, social engineering, or reconnaissance against staff or systems. While no direct data exposure occurs, the leaked information could aid further attacks.

Compliance Impact

This vulnerability may violate GDPR's data minimization principle by exposing unnecessary internal details. For HIPAA, it could risk unauthorized disclosure of operational information, though no PHI is directly exposed. Compliance impact depends on specific use cases and regulatory interpretations.

Mitigation Strategies

Upgrade to version 1.0.5 or later of OpenReception's appointment booking software to patch the issue. If upgrading is not immediately possible, restrict access to the /api/tenants/{id}/schedule endpoint through network-level controls or WAF rules.

Hi! I’m here to help you understand CVE-2026-48078. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70