Executive brief
OpenReception is an appointment booking platform used by healthcare providers to manage patient scheduling. The unauthenticated schedule API endpoint leaks the names, descriptions, and real-time availability of internal-only appointment channels that administrators explicitly marked as private. An attacker can enumerate private services, identify staff members, and monitor their schedules without authentication.
Technical details
The vulnerability is an information disclosure caused by incomplete authorization logic. The `/api/tenants/{id}/schedule` endpoint filters channels only by pause status and archive flag, but fails to check the `isPublic` flag despite the `addAppointmentToTunnel` endpoint enforcing it. An unauthenticated attacker can send a GET request with arbitrary date ranges to receive all non-archived channels with complete metadata including channel IDs, names, descriptions, assigned agents, and computed slot availability. The issue was fixed in version 1.0.5 by adding the missing `isPublic` filter. No authentication is required for exploitation.
Affected products
- OpenReception appointment booking software prior to 1.0.5
Timeline
- 2026-05-20: disclosed: Advisory published on GitHub
- 2026-08-06: patched: Version 1.0.5 released with fix