CVE-2026-48076

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48076", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T18:25:25.708Z", "datePublished": "2026-08-06T20:43:59.953Z", "dateUpdated": "2026-08-07T14:34:21.718Z"}, "containers": {"cna": {"title": "OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-3658-3j75-p5j3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-3658-3j75-p5j3"}], "affected": [{"vendor": "open-reception", "product": "appointment-booking-software", "versions": [{"version": "<= 1.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T20:43:59.953Z"}, "descriptions": [{"lang": "en", "value": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: `bootstrap-challenge` (returns a 16-bit PoW challenge with `difficulty=4` leading hex zeroes), `bootstrap-verify` (validates the PoW and issues a Bearer booking access token), and `create-new-client` (consumes the token and creates the tunnel and first appointment). The token correctly binds to `tenantId`, `tunnelId`, `clientPublicKey`, and `emailHash`, but never to `channelId`. The `bootstrap-challenge` request schema does not even accept a `channelId`, and the issued token's payload contains no channel information. Independently, the service function `createNewClientWithAppointment` checks only `channel.archived = false`. The `channel.isPublic` check that protects `addAppointmentToTunnel` is missing in the new-client path. The combination means: an attacker completes the bootstrap flow normally (16-bit PoW, completes in well under one second on commodity hardware, no rate limiting beyond the throttle store), receives a valid booking access token, and then submits the `create-new-client` payload with `channelId` pointing to a private (`isPublic = false`) channel. The booking lands as `CONFIRMED` if the target channel has `requiresConfirmation = false` (the default), otherwise as `NEW`. The patient-facing UI does not list private channels in its picker (`/api/public/channels` correctly filters `isPublic = true`), so the channel ID must be obtained out of band. The companion finding V-10 (schedule endpoint discloses private channels) provides exactly that: a single unauthenticated GET reveals every private channel ID for any tenant. V-10 plus V-11 together make private channels fully reachable to anonymous attackers. As of time of publication, no known patched versions are available."}], "source": {"advisory": "GHSA-3658-3j75-p5j3", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-3658-3j75-p5j3", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-07T14:34:15.376977Z", "id": "CVE-2026-48076", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T14:34:21.718Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48076", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T14:34:15.376977Z"}}}], "references": [{"url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-3658-3j75-p5j3", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T14:33:57.883Z"}}], "cna": {"title": "OpenReception's bootstrap booking flow allows unauthenticated booking on isPublic=false channels", "source": {"advisory": "GHSA-3658-3j75-p5j3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "open-reception", "product": "appointment-booking-software", "versions": [{"status": "affected", "version": "<= 1.0.1"}]}], "references": [{"url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-3658-3j75-p5j3", "name": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-3658-3j75-p5j3", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: `bootstrap-challenge` (returns a 16-bit PoW challenge with `difficulty=4` leading hex zeroes), `bootstrap-verify` (validates the PoW and issues a Bearer booking access token), and `create-new-client` (consumes the token and creates the tunnel and first appointment). The token correctly binds to `tenantId`, `tunnelId`, `clientPublicKey`, and `emailHash`, but never to `channelId`. The `bootstrap-challenge` request schema does not even accept a `channelId`, and the issued token's payload contains no channel information. Independently, the service function `createNewClientWithAppointment` checks only `channel.archived = false`. The `channel.isPublic` check that protects `addAppointmentToTunnel` is missing in the new-client path. The combination means: an attacker completes the bootstrap flow normally (16-bit PoW, completes in well under one second on commodity hardware, no rate limiting beyond the throttle store), receives a valid booking access token, and then submits the `create-new-client` payload with `channelId` pointing to a private (`isPublic = false`) channel. The booking lands as `CONFIRMED` if the target channel has `requiresConfirmation = false` (the default), otherwise as `NEW`. The patient-facing UI does not list private channels in its picker (`/api/public/channels` correctly filters `isPublic = true`), so the channel ID must be obtained out of band. The companion finding V-10 (schedule endpoint discloses private channels) provides exactly that: a single unauthenticated GET reveals every private channel ID for any tenant. V-10 plus V-11 together make private channels fully reachable to anonymous attackers. As of time of publication, no known patched versions are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T20:43:59.953Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48076", "state": "PUBLISHED", "dateUpdated": "2026-08-07T14:34:21.718Z", "dateReserved": "2026-05-20T18:25:25.708Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-06T20:43:59.953Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "appointment-booking-software", "vendor": "open-reception", "versions": [{"status": "affected", "version": "<= 1.0.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: `bootstrap-challenge` (returns a 16-bit PoW challenge with `difficulty=4` leading hex zeroes), `bootstrap-verify` (validates the PoW and issues a Bearer booking access token), and `create-new-client` (consumes the token and creates the tunnel and first appointment). The token correctly binds to `tenantId`, `tunnelId`, `clientPublicKey`, and `emailHash`, but never to `channelId`. The `bootstrap-challenge` request schema does not even accept a `channelId`, and the issued token's payload contains no channel information. Independently, the service function `createNewClientWithAppointment` checks only `channel.archived = false`. The `channel.isPublic` check that protects `addAppointmentToTunnel` is missing in the new-client path. The combination means: an attacker completes the bootstrap flow normally (16-bit PoW, completes in well under one second on commodity hardware, no rate limiting beyond the throttle store), receives a valid booking access token, and then submits the `create-new-client` payload with `channelId` pointing to a private (`isPublic = false`) channel. The booking lands as `CONFIRMED` if the target channel has `requiresConfirmation = false` (the default), otherwise as `NEW`. The patient-facing UI does not list private channels in its picker (`/api/public/channels` correctly filters `isPublic = true`), so the channel ID must be obtained out of band. The companion finding V-10 (schedule endpoint discloses private channels) provides exactly that: a single unauthenticated GET reveals every private channel ID for any tenant. V-10 plus V-11 together make private channels fully reachable to anonymous attackers. As of time of publication, no known patched versions are available."}, {"lang": "es", "value": "El software de reserva de citas de OpenReception proporciona una plataforma de reserva de citas cifrada de extremo a extremo. El flujo de reserva de nuevo cliente en las versiones 1.0.1 y anteriores consta de tres llamadas: \u201cbootstrap-challenge\u201d (devuelve un desaf\u00edo PoW de 16 bits con \u201cdifficulty=4\u201d ceros hexadecimales iniciales), \u201cbootstrap-verify\u201d (valida el PoW y emite un token de acceso de reserva Bearer), y \u201ccreate-new-client\u201d (consume el token y crea el t\u00fanel y la primera cita). El token se vincula correctamente a \u201ctenantId\u201d, \u201ctunnelId\u201d, \u201cclientPublicKey\u201d, y \u201cemailHash\u201d, pero nunca a \u201cchannelId\u201d. El esquema de solicitud de \u201cbootstrap-challenge\u201d ni siquiera acepta un \u201cchannelId\u201d, y la carga \u00fatil del token emitido no contiene informaci\u00f3n de canal. Independientemente, la funci\u00f3n de servicio \u201ccreateNewClientWithAppointment\u201d solo verifica \u201cchannel.archived = false\u201d. La verificaci\u00f3n de \u201cchannel.isPublic\u201d que protege \u201caddAppointmentToTunnel\u201d falta en la ruta de nuevo cliente. La combinaci\u00f3n significa: un atacante completa el flujo de arranque normalmente (PoW de 16 bits, se completa en bastante menos de un segundo en hardware comercial, sin limitaci\u00f3n de velocidad m\u00e1s all\u00e1 del almac\u00e9n de aceleraci\u00f3n), recibe un token de acceso de reserva v\u00e1lido, y luego env\u00eda la carga \u00fatil de \u201ccreate-new-client\u201d con \u201cchannelId\u201d apuntando a un canal privado (\u201cisPublic = false\u201d). La reserva se registra como \u201cCONFIRMED\u201d si el canal de destino tiene \u201crequiresConfirmation = false\u201d (el valor predeterminado), de lo contrario, como \u201cNEW\u201d. La interfaz de usuario orientada al paciente no lista canales privados en su selector (\u201c/api/public/channels\u201d filtra correctamente \u201cisPublic = true\u201d), por lo que el ID del canal debe obtenerse fuera de banda. El hallazgo complementario V-10 (el endpoint de programaci\u00f3n revela canales privados) proporciona exactamente eso: una \u00fanica solicitud GET no autenticada revela cada ID de canal privado para cualquier inquilino. V-10 m\u00e1s V-11 juntos hacen que los canales privados sean totalmente accesibles para atacantes an\u00f3nimos. A partir del momento de la publicaci\u00f3n, no hay versiones parcheadas conocidas disponibles."}], "id": "CVE-2026-48076", "lastModified": "2026-10-23T21:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48076", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-07T14:34:15.376977Z", "version": "2.0.3"}}]}, "published": "2026-08-06T22:17:10.127", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-3658-3j75-p5j3"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-3658-3j75-p5j3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "appointment-booking-software", "source": "cna", "vendor": "open-reception"}, "product": "appointment-booking-software", "vendor": "open-reception"}], "created": "2026-08-07T01:00:05.866966+00:00", "updated": "2026-08-07T09:59:03.643610+00:00", "vendors": ["open-reception", "open-reception$PRODUCT$appointment-booking-software"]}