---
id: CVE-2026-48078
title: >-
  OpenReception's appointment booking software provides an end-to-end encrypted
  appointment booking platform
summary: >-
  OpenReception's appointment booking software provides an end-to-end encrypted
  appointment booking platform. Prior to version 1.0.5, the unauthenticated
  `/api/tenants/{id}/schedule` endpoint returns every non-archived channel for a
  tenant…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-200
published: '2026-08-06'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:51:43.490'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48078'
references:
  - url: >-
      https://github.com/open-reception/appointment-booking-software/commit/f47320dd8a236750442a60cb32829b04e99eb8df
    label: security-advisories@github.com
  - url: >-
      https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-v6fw-m2mg-5gr9
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00343
epssPercentile: 0.25008
ingestedAt: '2026-08-09T00:31:24.878Z'
---

## Overview

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticated `/api/tenants/{id}/schedule` endpoint returns every non-archived channel for a tenant regardless of the channel's `isPublic` flag. Channels marked `isPublic = false` are intended to be invisible to public callers; the dashboard creates them deliberately to hide internal-only services from the patient booking UI. The schedule endpoint ignores the flag entirely and discloses channel names, descriptions, IDs, agent associations, pause status, confirmation requirements, and computed slot availability for the requested date range. The asymmetry between `addAppointmentToTunnel` (which enforces `eq(channel.isPublic, true)`) and the schedule endpoint (which does not) confirms the design intent: private channels exist as a real access boundary in the booking flow, just not in the schedule disclosure. Version 1.0.5 patches the issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.