CVE-2026-48077 Details
Description
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at `/api/tenants/{id}/appointments/{appointmentId}` performs no authorization check before returning the appointment record. Any party who knows or obtains a valid appointment UUID receives the full row, including channel and agent IDs, time and timezone, status, and the AES-GCM ciphertext components (`encryptedPayload`, `iv`, `authTag`, `dataKey`). The same file's DELETE handler calls `checkPermission(locals, tenantId, true)` before allowing deletion. The intent is clear: appointment records are tenant-scoped and require authentication to access. The GET handler is missing the equivalent call. The middleware chain (`apiAuthHandle`, `authGuard`) does not compensate: API paths bypass `authGuard` entirely, and `apiAuthHandle` does not block requests to non-admin paths when no token is present. Version 1.1.0 patches the issue.
A vulnerability exists in OpenReception's appointment booking software, specifically in versions prior to 1.1.0. The issue arises in the GET handler of the endpoint '/api/tenants/{id}/appointments/{appointmentId}', which lacks proper authorization checks. As a result, any individual with a valid appointment UUID can access the full appointment record, including sensitive information such as channel and agent IDs, appointment details, and encrypted payload components. This oversight allows unauthorized access to appointment data, which is intended to be tenant-scoped and requires authentication.
Users can update to OpenReception version 1.1.0 or later, where this vulnerability is patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 6, 2026CISA-ADP
Assessed Aug 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-8547-9x2c-9vmf | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/open-reception/appointment-booking-software/commit/16474d96c591e246a103b9d6aa15ca30d436d11b | [email protected] | Source CodeVendor |
| https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-8547-9x2c-9vmf | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenReception | <= 1.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |