Executive brief
OpenReception is an end-to-end encrypted appointment booking platform used by healthcare and service providers to manage patient/client appointments securely. A critical authorization bypass vulnerability in the GET appointment API endpoint allows any attacker who knows a valid appointment UUID to retrieve the full appointment record without authentication, exposing sensitive operational metadata (dates, times, channel IDs, agent IDs), patient tunnel identifiers, and encrypted payload components that could be used in offline cryptographic attacks. This bypasses the platform's intended encryption and access controls.
Technical details
The vulnerability is a missing authorization check in the GET handler at `/api/tenants/{id}/appointments/{appointmentId}`. The endpoint returns the complete appointment record (including AES-GCM ciphertext components: encryptedPayload, iv, authTag, and dataKey) based only on knowledge of the appointment UUID, with no authentication or permission validation. The DELETE handler in the same file correctly calls `checkPermission(locals, tenantId, true)` before allowing deletion, demonstrating the intended security model. The middleware chain (`apiAuthHandle` and `authGuard`) does not compensate: API paths bypass `authGuard` entirely, and `apiAuthHandle` does not reject unauthenticated requests to non-admin paths. An attacker with network access can enumerate or obtain appointment UUIDs through various channels (server logs, confirmation emails, browser history) and retrieve sensitive metadata and encryption artifacts. Version 1.1.0 patches the issue by adding the missing permission check.
Affected products
- OpenReception appointment-booking-software <= 1.0.1
Timeline
- 2026-05-20: disclosed
- 2026-05-31: patched: Version 1.1.0 released with authorization check added
- 2026-08-06: advisory: CVE-2026-48077 published