CVE-2026-48078

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.5

Description The unauthenticated '/api/tenants/{id}/schedule' endpoint returns all non-archived channels for a tenant, ignoring the isPublic flag. This allows the disclosure of private channels intended to be hidden from public callers, exposing channel names, descriptions, IDs, agent associations, pause status, confirmation requirements, and computed slot availability. This occurs because the schedule endpoint fails to enforce the same visibility restrictions as the addAppointmentToTunnel() function.

Recommendations Update to version 1.0.5.