CVE-2026-48078 open-reception CVE debrief

Who should care

Defenders responsible for OpenReception's appointment booking software, particularly those managing tenant configurations and channel settings, should assess exposure and prioritize upgrading to version 1.0.5 or later.

Why it matters

CVE-2026-48078 allows public callers to access private channel information in OpenReception's appointment booking software prior to version 1.0.5. Defenders should verify exposure, prioritize upgrading, and monitor for unauthorized access.

• Verification of private channel exposure to unauthorized users
• Potential unauthorized access to sensitive channel information
• Need for upgrade to version 1.0.5 or later to patch the issue
• Monitoring for suspicious activity related to channel information disclosure

Technical summary

The unauthenticated `/api/tenants/{id}/schedule` endpoint in OpenReception's appointment booking software prior to version 1.0.5 returns every non-archived channel for a tenant, disregarding the channel's `isPublic` flag. This allows public callers to access information intended to be hidden from the patient booking UI, including channel names, descriptions, IDs, agent associations, pause status, confirmation requirements, and computed slot availability.

Defensive priority

Defenders should prioritize verifying exposure of private channels and upgrading to version 1.0.5 or later.

Recommended defensive actions

• Verify exposure of private channels in the appointment booking software
• Upgrade to version 1.0.5 or later
• Monitor for unauthorized access to private channel information
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its patch. GitHub references provide additional context on the fix. Defenders should verify exposure of private channels and review official advisories for affected scope, severity, and vendor guidance. The unauthenticated `/api/tenants/{id}/schedule` endpoint discloses private channel details, including names, descriptions, IDs, agent associations, pause status, confirmation requirements, and computed slot availability. This issue allows public callers to access (

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.