CVE-2026-75525 open-reception CVE debrief

Who should care

Defenders responsible for OpenReception software deployments, especially those with active staff keys, should assess exposure and prioritize verification and potential compensating controls.

Why it matters

CVE-2026-75525 allows unauthenticated ML-KEM key injection into OpenReception's staff-crypto recipient directory, breaking end-to-end encryption guarantees for appointment data. Defenders should prioritize verifying exposure, especially for tenants with active staff keys, and assess the need for compensating controls or monitoring.

• Potential unauthorized receipt of appointment data encryption keys
• Breakage of end-to-end encryption guarantees for appointment data
• Need for verification of exposure and potential compensating controls
• Possible impact on confidentiality of appointment data

Technical summary

The vulnerability allows an unauthenticated attacker to store an arbitrary ML-KEM-768 public key under any existing user's identity in any tenant's staff-crypto recipient directory. This breaks the end-to-end encryption guarantee for appointment data, as the injected key receives the tunnel key of every appointment booked afterward in that tenant. The issue arises from an endpoint that does not properly authenticate or authorize key injection, permitting an attacker to become a persistent, unauthorized recipient of appointment data encryption keys.

Defensive priority

Defenders should prioritize verifying exposure, especially for tenants with active staff keys, and assess the need for compensating controls or monitoring.

Recommended defensive actions

• Verify exposure by checking OpenReception software versions and tenant configurations, especially for tenants with active staff keys.
• Assess the need for compensating controls or monitoring to protect appointment data.
• Consider implementing additional security measures for staff-crypto recipient directories.
• Review vendor guidance for OpenReception software updates or mitigations.
• Perform an inventory of assets using OpenReception software to prioritize remediation efforts.
• Monitor relevant logs and detection systems for potential exploitation attempts.
• Track exceptions and retest remediated assets to ensure vulnerability resolution.

Evidence notes

The CVE record and source item provide details on the vulnerability, but no publicly available patches are mentioned. The NVD entry is currently UNCLASSIFIED. Evidence is limited to CVE Program and NVD sources, which describe the vulnerability but do not provide explicit verification guidance. Defenders should verify exposure by checking OpenReception software versions and tenant configurations, especially for tenants with active staff keys.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.