Authorization Flaw in OpenReception's Appointment Booking Software
CVE-2026-48077

5.3MEDIUM

Key Information:

Vendor

Open-reception

Status
Appointment-booking-software
Vendor
CVE Published:
6 August 2026

What is CVE-2026-48077?

OpenReception's Appointment Booking Software contains a critical vulnerability in its GET handler for appointment records. Prior to version 1.1.0, the handler at /api/tenants/{id}/appointments/{appointmentId} lacked necessary authorization checks, allowing anyone in possession of a valid appointment UUID to access sensitive information. This included details such as channel IDs, agent IDs, timestamps, and encrypted data components without proper authentication. Consequently, this oversight poses serious risks regarding data confidentiality and could potentially lead to unauthorized data access. Version 1.1.0 addresses this issue by implementing the required authorization checks.

Affected Version(s)

appointment-booking-software < 1.1.0

References

https://github.com/open-reception/appointment-booking-sof...
x_refsource_CONFIRM
https://github.com/open-reception/appointment-booking-sof...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.