CVE-2026-48075

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.5

Description The add-to-tunnel endpoint allows the creation of new appointment rows in any client tunnel without caller authentication. By providing a valid tunnelId and emailHash, an attacker can insert appointments with a status of "CONFIRMED", controlling the ciphertext fields, date, duration, and the chosen agent. The system only verifies that a tunnel exists for the provided emailHash but does not authenticate the caller as the owner of the tunnelId. This occurs because the endpoint is included in the public-route allowlist and lacks requirements for sessions, Authorization headers, booking access tokens, or Proof of Work (PoW), a mechanism used to prove that a client has performed a certain amount of computation to prevent spam or abuse.

Recommendations Update to version 1.0.5. As a temporary workaround, restrict access to the add-to-tunnel endpoint to minimize the risk of unauthorized appointment creation.