CVE-2026-48077: OpenReception appointment booking missing authorization in GET handler

CVE-2026-48077 · Severity: medium · CVSS 5.3 · Published 2026-08-06

OpenReception is an end-to-end encrypted appointment booking platform used by healthcare and service providers to manage patient/client appointments securely. A critical authorization bypass vulnerability in the GET appointment API endpoint allows any attacker who knows a valid appointment UUID to retrieve the full appointment record without authentication, exposing sensitive operational metadata (dates, times, channel IDs, agent IDs), patient tunnel identifiers, and encrypted payload components that could be used in offline cryptographic attacks. This bypasses the platform's intended encryption and access controls.

Technologies: OpenReception Appointment-Booking-Software. Vendors: OpenReception.

Quick answers

Is CVE-2026-48077 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48077 being exploited in the wild.
How severe is CVE-2026-48077?
Medium severity, with a CVSS score of 5.3, published 6 August 2026.
Which products and versions are affected?
OpenReception Appointment-Booking-Software <= 1.0.1.
Is there a fix for CVE-2026-48077?
A patch was published on 2026-05-31: Version 1.1.0 released with authorization check added Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48077 attacked?
It is attacked over the network.
Am I affected by CVE-2026-48077?
Check whether you run OpenReception Appointment-Booking-Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authorization check in the GET handler at `/api/tenants/{id}/appointments/{appointmentId}`. The endpoint returns the complete appointment record (including AES-GCM ciphertext components: encryptedPayload, iv, authTag, and dataKey) based only on knowledge of the appointment UUID, with no authentication or permission validation. The DELETE handler in the same file correctly calls `checkPermission(locals, tenantId, true)` before allowing deletion, demonstrating the intended security model. The middleware chain (`apiAuthHandle` and `authGuard`) does not compensate: API paths bypass `authGuard` entirely, and `apiAuthHandle` does not reject unauthenticated requests to non-admin paths. An attacker with network access can enumerate or obtain appointment UUIDs through various channels (server logs, confirmation emails, browser history) and retrieve sensitive metadata and encryption artifacts. Version 1.1.0 patches the issue by adding the missing permission check.

Affected products

  • OpenReception appointment-booking-software <= 1.0.1

Timeline

  • 2026-05-20: disclosed
  • 2026-05-31: patched: Version 1.1.0 released with authorization check added
  • 2026-08-06: advisory: CVE-2026-48077 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.