CVE-2026-75524 Details
Description
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is designed to keep exclusive. The number of overlapping appointments equals the number of concurrent requests, and one booking token is enough because the token is consumed after the insert. This results in the integrity of the booking-calendar breaking and availability being denied to other clients. This issue has been patched in version 2.2.2.
A race condition vulnerability has been identified in OpenReception's appointment booking software, prior to version 2.2.2. The issue allows an attacker to overbook an agent by sending multiple appointment requests simultaneously for the same time slot, which the system is designed to keep exclusive. This exploitation can lead to conflicting appointments in the agent's schedule, disrupting normal operations and availability for other clients. The vulnerability arises because the server-side check to prevent double bookings is not atomic with the appointment insertion, allowing concurrent requests to bypass the availability verification. This issue has been patched in version 2.2.2.
Users can update to OpenReception Appointment Booking Software version 2.2.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-q452-m9pf-qj9j | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/open-reception/appointment-booking-software/commit/73663288a8d4ad2ad31d897dc1f494ace2f0e452 | [email protected] | Source CodeVendor |
| https://github.com/open-reception/appointment-booking-software/releases/tag/v2.2.2 | [email protected] | Release NotesVendor |
| https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-q452-m9pf-qj9j | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenReception | <= 2.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |