CVE-2026-48076

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.1

Description The new-client booking flow fails to validate if a channel is public when creating a new client appointment. The process involves three calls: bootstrap-challenge, bootstrap-verify, and create-new-client. While the issued Bearer booking access token binds to several identifiers, it does not bind to the channelId. Furthermore, the createNewClientWithAppointment() function only verifies that a channel is not archived, omitting the check for channel.isPublic that is present in other paths. This allows an attacker to obtain a valid token and submit a create-new-client payload with a channelId belonging to a private channel. If the private channel has requiresConfirmation set to false, the booking is automatically confirmed. This issue is exacerbated by a separate flaw where an unauthenticated GET request to the schedule endpoint discloses private channel IDs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.