These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-48088 debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T22:17:11.893Z and has not been modified since then. The NVD entry is currently Deferred. OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route `POST /api/tenants/{tenantId}/staff/{staffId}/crypto` accepts and stores a [truncated]
CVE-2026-48087 debrief: OpenReception appointment booking software vulnerability allows unauthenticated attackers to perform account takeover by exploiting the registration handler. The vulnerability exists due to a lack of validation in the registration handler at `POST /api/auth/register/{userId}`, which allows an attacker to submit a registration response with their own authenticator against any victim [truncated]
CVE-2026-48086 is a critical vulnerability in OpenReception's appointment booking software that allows a tenant administrator to escalate their privileges to platform-wide administrative control. This issue was fixed in version 1.0.2. The vulnerability is caused by a lack of policy check in the role-update handler, allowing a tenant administrator to promote themselves to platform-wide GLOBAL_ADMIN. The ro [truncated]
CVE-2026-48085 debrief: OpenReception appointment booking software prior to version 1.0.1 creates additional GLOBAL_ADMIN accounts without verification, allowing unauthenticated network attackers to gain full platform-level administrative control. The vulnerability is distinct from a documented deployment race condition and works after proper claiming and configuration. The bug allows creation of active G [truncated]
CVE-2026-48084 is a high-severity vulnerability in OpenReception's appointment booking software, allowing unlimited failed passphrase login attempts. This oversight makes it susceptible to credential stuffing and dictionary attacks, as the throttle infrastructure exists but was not implemented for the passphrase branch. The vulnerability was addressed in version 1.0.2. Defenders should assess exposure and [truncated]
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the `/api/log` endpoint accepts unauthenticated POST requests, applies no schema validation to the message body, writes attacker-controlled content directly into the application's stdout log, interprets newline characters as real line breaks, and enforces no size or rate limi [truncated]
CVE-2026-48082 is a vulnerability in OpenReception's appointment booking software that allows for easy abuse of the patient booking flow due to a low difficulty proof-of-work challenge. The issue was fixed in version 1.0.6. The vulnerability allows an attacker to solve proof-of-work challenges quickly, defeating the rate-limiting purpose. Defenders should assess exposure and prioritize verification and re [truncated]
CVE-2026-48080 debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T22:17:10.703Z and has not been modified since then. The NVD entry is currently Deferred. OpenReception's appointment booking software provides end-to-end encrypted appointment booking. Prior to version 1.0.2, a TENANT_ADMIN can access sensitive database credentials via the `GET /api/tenants/{id}` endpoin [truncated]
CVE-2026-48079 is a high-severity vulnerability in OpenReception's appointment booking software. A simple ordering mistake in the `/logout` page's server-side load handler allows an attacker to continue making authenticated API calls even after a user logs out, until the session naturally expires. The vulnerability affects OpenReception's appointment booking software prior to version 1.0.2. Defenders shou [truncated]
CVE-2026-48078 debrief: OpenReception's appointment booking software prior to version 1.0.5 discloses private channel details via the unauthenticated `/api/tenants/{id}/schedule` endpoint, exposing channel names, descriptions, IDs, agent associations, pause status, confirmation requirements, and computed slot availability. This issue allows public callers to access information intended to be hidden from t [truncated]
CVE-2026-48076 is a vulnerability in OpenReception's appointment booking software that allows an attacker to book an appointment in a private channel without authorization. The vulnerability exists because the `createNewClientWithAppointment` function does not check if a channel is public before booking an appointment. This, combined with another vulnerability that discloses private channel IDs, makes pri [truncated]
CVE-2026-48075 is a MEDIUM-severity vulnerability in OpenReception's appointment booking software. The add-to-tunnel endpoint allows an unauthenticated attacker to create a new appointment row in any client tunnel. This vulnerability has significant implications for the security of client tunnels and appointment data. Users of OpenReception's appointment booking software, administrators of client tunnels, [truncated]
CVE-2026-48074 is a low-severity vulnerability in OpenReception's appointment booking software. When a tenant administrator deletes a staff user, the software incorrectly removes pending invites for that email address across all tenants, not just the administrator's tenant. This issue was patched in version 1.0.6. The vulnerability allows an attacker to inadvertently delete pending invites in other tenant [truncated]
CVE-2026-48071 is a vulnerability in OpenReception's appointment booking software that allows an attacker to lock out a patient on one tenant by issuing failed challenge responses against another tenant, due to the shared challenge throttle table across all tenants. The vulnerability exists because the PIN-type challenge throttle uses `emailHash` as the only key, and the throttle rows live in the central [truncated]
