CVE-2026-48078— OpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callers
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-48078
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenReception's schedule endpoint discloses isPublic=false channels and slot availability to unauthenticated callers
Source: CVE Program / CVE List V5
Vulnerability Description
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticated `/api/tenants/{id}/schedule` endpoint returns every non-archived channel for a tenant regardless of the channel's `isPublic` flag. Channels marked `isPublic = false` are intended to be invisible to public callers; the dashboard creates them deliberately to hide internal-only services from the patient booking UI. The schedule endpoint ignores the flag entirely and discloses channel names, descriptions, IDs, agent associations, pause status, confirmation requirements, and computed slot availability for the requested date range. The asymmetry between `addAppointmentToTunnel` (which enforces `eq(channel.isPublic, true)`) and the schedule endpoint (which does not) confirms the design intent: private channels exist as a real access boundary in the booking flow, just not in the schedule disclosure. Version 1.0.5 patches the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| open-reception | appointment-booking-software | < 1.0.5 | - |
II. Public POCs for CVE-2026-48078
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-48078
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-48078 (1)
Vendor Advisories for CVE-2026-48078 (1)
Same Patch Batch · open-reception · 2026-08-06 · 16 CVEs total
| CVE-2026-48086 | 9.9 CRITICAL | OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN |
| CVE-2026-48087 | 9.8 CRITICAL | OpenReception: WebAuthn passkey injection allows account takeover |
| CVE-2026-48085 | 9.8 CRITICAL | OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap |
| CVE-2026-48088 | 9.4 CRITICAL | OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipie |
| CVE-2026-48081 | 8.1 HIGH | OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links render |
| CVE-2026-48080 | 8.0 HIGH | OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superu |
| CVE-2026-48084 | 7.4 HIGH | OpenReception doesn't rate limit passphrase login attempts |
| CVE-2026-48079 | 7.4 HIGH | OpenReception's logout page clears local access_token before server-side revocation, leavi |
| CVE-2026-48076 | 6.5 MEDIUM | OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false ch |
| CVE-2026-48083 | 6.5 MEDIUM | OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection |
| CVE-2026-48075 | 6.5 MEDIUM | OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injec |
| CVE-2026-48071 | 5.8 MEDIUM | OpenReception's client PIN challenge throttle is keyed by emailHash only, allowing cross-t |
| CVE-2026-48077 | 5.3 MEDIUM | OpenReception: GET appointment by ID returns full appointment record without authorization |
| CVE-2026-48082 | 3.7 LOW | OpenReception's bootstrap challenge proof-of-work difficulty hardcoded to 16 bits, which e |
| CVE-2026-48074 | 2.7 LOW | OpenReception: Staff deletion removes pending invites cross-tenant by email match |
IV. Related Vulnerabilities
Same product: appointment-booking-software
- CVE-2026-48088
OpenReception vulnerable to unauthenticated staff crypto poi - CVE-2026-48087
OpenReception: WebAuthn passkey injection allows account tak - CVE-2026-48086
OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN - CVE-2026-48085
OpenReception has unauthenticated GLOBAL_ADMIN account creat - CVE-2026-48084
OpenReception doesn't rate limit passphrase login attempts
Same vendor: open-reception
- CVE-2026-48088
OpenReception vulnerable to unauthenticated staff crypto poi - CVE-2026-48087
OpenReception: WebAuthn passkey injection allows account tak - CVE-2026-48086
OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN - CVE-2026-48085
OpenReception has unauthenticated GLOBAL_ADMIN account creat - CVE-2026-48084
OpenReception doesn't rate limit passphrase login attempts
Same weakness: CWE-200
- CVE-2026-54203
TeamDavid: Memory Leak leaking sensitive information - CVE-2026-45378
Decidim: Verification documents can be downloaded through re - CVE-2026-64664
Statamic: Missing authorization on Control Panel endpoint al - CVE-2026-71433
LangGraph: Namespace prefix matching crosses segment boundar - CVE-2026-48080
OpenReception's tenant detail endpoint discloses live Postgr
V. Comments for CVE-2026-48078
No comments yet