# CVE-2026-48078: OpenReception appointment booking software information disclosure in schedule endpoint

Source: https://junglewise.ai/threats/cve-2026-48078-openreception-appointment-booking-software-information-disclosure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-48078 · Severity: medium · CVSS 5.3 · Published 2026-08-06

OpenReception is an appointment booking platform used by healthcare providers to manage patient scheduling. The unauthenticated schedule API endpoint leaks the names, descriptions, and real-time availability of internal-only appointment channels that administrators explicitly marked as private. An attacker can enumerate private services, identify staff members, and monitor their schedules without authentication.

Technologies: [OpenReception Appointment-Booking-Software](https://junglewise.ai/threats/technologies/appointment-booking-software). Vendors: [OpenReception](https://junglewise.ai/threats/vendors/openreception).

## Quick answers

**Is CVE-2026-48078 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48078 being exploited in the wild.

**How severe is CVE-2026-48078?** Medium severity, with a CVSS score of 5.3, published 6 August 2026.

**Which products and versions are affected?** OpenReception Appointment-Booking-Software prior to 1.0.5.

**Is there a fix for CVE-2026-48078?** A patch was published on 2026-08-06: Version 1.0.5 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48078 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-48078?** Check whether you run OpenReception Appointment-Booking-Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an information disclosure caused by incomplete authorization logic. The `/api/tenants/{id}/schedule` endpoint filters channels only by pause status and archive flag, but fails to check the `isPublic` flag despite the `addAppointmentToTunnel` endpoint enforcing it. An unauthenticated attacker can send a GET request with arbitrary date ranges to receive all non-archived channels with complete metadata including channel IDs, names, descriptions, assigned agents, and computed slot availability. The issue was fixed in version 1.0.5 by adding the missing `isPublic` filter. No authentication is required for exploitation.

## Affected products

- OpenReception appointment booking software prior to 1.0.5

## Timeline

- 2026-05-20: disclosed: Advisory published on GitHub
- 2026-08-06: patched: Version 1.0.5 released with fix

## References

- [https://github.com/open-reception/appointment-booking-software/commit/f47320dd8a236750442a60cb32829b04e99eb8df](https://github.com/open-reception/appointment-booking-software/commit/f47320dd8a236750442a60cb32829b04e99eb8df)
- [https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-v6fw-m2mg-5gr9](https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-v6fw-m2mg-5gr9)

## Related threats

- [OpenReception Appointment Booking unauthenticated ML-KEM key injection](https://junglewise.ai/threats/cve-2026-75525-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking race condition in event creation](https://junglewise.ai/threats/cve-2026-75524-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking software authentication bypass in PIN throttle](https://junglewise.ai/threats/cve-2026-65825-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking software invite token replay](https://junglewise.ai/threats/cve-2026-65824-openreception-s-appointment-booking-software-provides-an-end-to)
- [OpenReception appointment booking account takeover via Host header spoofing](https://junglewise.ai/threats/cve-2026-58202-openreception-s-appointment-booking-software-provides-an-end-to)