---
id: CVE-2026-75524
title: >-
  OpenReception: race condition in add-to-tunnel and create-new-client allows
  overlapping appointments for one agent
summary: >-
  OpenReception's appointment booking software provides an end-to-end encrypted
  appointment booking platform. Prior to version 2.2.2, an attacker overbooks an
  agent, placing multiple appointments into a single time slot that the system
  is …
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-367
vendor: open-reception
product: appointment-booking-software
affected:
  - appointment-booking-software < 2.2.2
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T20:29:52.583Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-75524'
references:
  - url: >-
      https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-q452-m9pf-qj9j
    label: >-
      https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-q452-m9pf-qj9j
  - url: >-
      https://github.com/open-reception/appointment-booking-software/commit/73663288a8d4ad2ad31d897dc1f494ace2f0e452
    label: >-
      https://github.com/open-reception/appointment-booking-software/commit/73663288a8d4ad2ad31d897dc1f494ace2f0e452
  - url: >-
      https://github.com/open-reception/appointment-booking-software/releases/tag/v2.2.2
    label: >-
      https://github.com/open-reception/appointment-booking-software/releases/tag/v2.2.2
tags:
  - cve.org
ingestedAt: '2026-10-23T21:38:13.059Z'
---

## Overview

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is designed to keep exclusive. The number of overlapping appointments equals the number of concurrent requests, and one booking token is enough because the token is consumed after the insert. This results in the integrity of the booking-calendar breaking and availability being denied to other clients. This issue has been patched in version 2.2.2.

## Affected

- `appointment-booking-software < 2.2.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.