PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48076 open-reception CVE debrief

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: `bootstrap-challenge`, `bootstrap-verify`, and `create-new-client`. The token correctly binds to `tenantId`, `tunnelId`, `clientPublicKey`, and `emailHash`, but never to `channelId`. The `bootstrap-challenge` request schema does not even accept a `channelId`, and the issued token's payload contains no channel information. Independently, the service function `createNewClientWithAppointment` checks only `channel.archived = false`. The `channel.isPublic` check that protects `addAppointmentToTunnel` is missing in the new-client path. The combination means: an attacker completes the bootstrap flow normally, receives a valid booking access token, and then submits the `create-new-client` payload with `channelId` pointing to a private (`isPublic = false`) channel. The booking lands as `CONFIRMED` if the target channel has `requiresConfirmation = false`, otherwise as `NEW`. The patient-facing UI does not list private channels in its picker, so the channel ID must be obtained out of band. The companion finding provides exactly that: a single unauthenticated GET reveals every private channel ID for any tenant. Together make private channels fully reachable to anonymous attackers. As of time of publication, no known patched versions are available. This vulnerability allows attackers to bypass authorization checks when creating appointments in private channels, potentially leading to unauthorized access and data breaches. Users of OpenReception's appointment booking software, particularly those with private channels, should be aware of this vulnerability and take steps to protect themselves. This includes verifying that their software is up-to-date and implementing additional monitoring and validation checks to prevent unauthorized access to private channels.

Vendor
open-reception
Product
appointment-booking-software
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-06
Original CVE updated
2026-08-07
Advisory published
2026-08-06
Advisory updated
2026-08-07

Who should care

Users of OpenReception's appointment booking software, particularly those with private channels, should be aware of this vulnerability and take steps to protect themselves. This includes verifying that their software is up-to-date and implementing additional monitoring and validation checks to prevent unauthorized access to private channels.

Technical summary

The new-client booking flow in OpenReception's appointment booking software versions 1.0.1 and prior is vulnerable to unauthorized access to private channels. An attacker can complete the bootstrap flow, receive a valid booking access token, and then submit the `create-new-client` payload with a `channelId` pointing to a private channel. The booking lands as `CONFIRMED` if the target channel has `requiresConfirmation = false`, otherwise as `NEW`.

Defensive priority

CVE-2026-48076 allows attackers to bypass authorization checks when creating appointments in private channels. To address this vulnerability, verify that your OpenReception appointment booking software is properly configured and up-to-date. Implement additional monitoring and validation checks to prevent unauthorized access to private channels.

Recommended defensive actions

  • Verify that your OpenReception appointment booking software is properly configured and up-to-date.
  • Implement additional monitoring and validation checks to prevent unauthorized access to private channels.
  • Restrict access to private channels to authorized users only.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE description provides details about the vulnerability in OpenReception's appointment booking software. The new-client booking flow in versions 1.0.1 and prior is vulnerable to unauthorized access to private channels. The service function `createNewClientWithAppointment` checks only `channel.archived = false`, and the `channel.isPublic` check is missing in the new-client path.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T22:17:10.127Z and has not been modified since then.