CVE-2026-48076

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: `bootstrap-challenge` (returns a 16-bit PoW challenge with `difficulty=4` leading hex zeroes), `bootstrap-verify` (validates the PoW and issues a Bearer booking access token), and `create-new-client` (consumes the token and creates the tunnel and first appointment). The token correctly binds to `tenantId`, `tunnelId`, `clientPublicKey`, and `emailHash`, but never to `channelId`. The `bootstrap-challenge` request schema does not even accept a `channelId`, and the issued token's payload contains no channel information. Independently, the service function `createNewClientWithAppointment` checks only `channel.archived = false`. The `channel.isPublic` check that protects `addAppointmentToTunnel` is missing in the new-client path. The combination means: an attacker completes the bootstrap flow normally (16-bit PoW, completes in well under one second on commodity hardware, no rate limiting beyond the throttle store), receives a valid booking access token, and then submits the `create-new-client` payload with `channelId` pointing to a private (`isPublic = false`) channel. The booking lands as `CONFIRMED` if the target channel has `requiresConfirmation = false` (the default), otherwise as `NEW`. The patient-facing UI does not list private channels in its picker (`/api/public/channels` correctly filters `isPublic = true`), so the channel ID must be obtained out of band. The companion finding V-10 (schedule endpoint discloses private channels) provides exactly that: a single unauthenticated GET reveals every private channel ID for any tenant. V-10 plus V-11 together make private channels fully reachable to anonymous attackers. As of time of publication, no known patched versions are available.

• CWE-863

• https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-3658-3j75-p5j3
• https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-3658-3j75-p5j3

Published

Aug 6, 2026

Last Modified

Aug 7, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48068@grpc/grps-js implements the core functionality of gRPC pure…7.5
• CVE-2026-48069@grpc/grps-js implements the core functionality of gRPC pure…7.5
• CVE-2026-4807The Appointment Booking Calendar plugin for WordPress is vul…6.5
• CVE-2026-48071OpenReception's appointment booking software provides an end…5.8
• CVE-2026-48074OpenReception's appointment booking software provides an end…2.7
• CVE-2026-48075OpenReception's appointment booking software provides an end…6.5
• CVE-2026-48077OpenReception's appointment booking software provides an end…5.3
• CVE-2026-48078OpenReception's appointment booking software provides an end…5.3
• CVE-2026-48079OpenReception's appointment booking software provides an end…7.4
• CVE-2026-4808The Gerador de Certificados – DevApps plugin for WordPress i…7.2
• CVE-2026-48080OpenReception's appointment booking software provides an end…8
• CVE-2026-48081OpenReception's appointment booking software provides an end…8.1