CVE-2026-48077

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.1.0

Description The GET handler at the endpoint /api/tenants/{id}/appointments/{appointmentId} fails to perform authorization checks. This allows any party with a valid appointment UUID to retrieve the full appointment record, including channel and agent IDs, time, timezone, status, and AES-GCM ciphertext components such as encryptedPayload, iv, authTag, and dataKey. AES-GCM is an authenticated encryption mode that provides both confidentiality and authenticity. The issue exists because the GET handler lacks the checkPermission() function call used by other handlers, and the middleware chain consisting of apiAuthHandle and authGuard does not block requests to these paths when no token is present.

Recommendations Update to version 1.1.0.