CVE-2026-48081

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48081", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T18:40:45.830Z", "datePublished": "2026-08-06T21:10:28.470Z", "dateUpdated": "2026-08-07T14:31:48.743Z"}, "containers": {"cna": {"title": "OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-xpr7-wx69-mp36", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-xpr7-wx69-mp36"}, {"name": "https://github.com/open-reception/appointment-booking-software/commit/98a107d4b4eaeab5cbb96ee0a28c2342b853eee0", "tags": ["x_refsource_MISC"], "url": "https://github.com/open-reception/appointment-booking-software/commit/98a107d4b4eaeab5cbb96ee0a28c2342b853eee0"}], "affected": [{"vendor": "open-reception", "product": "appointment-booking-software", "versions": [{"version": "< 1.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T21:10:28.470Z"}, "descriptions": [{"lang": "en", "value": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN can store `javascript:` URLs in the tenant `links` configuration (`website`, `imprint`, `privacyStatement`). These values are returned to the patient-facing landing page via `/api/public`, hydrated into the SvelteKit Button component, and rendered as `<a href=\"javascript:...\">` elements without URL-scheme filtering. A patient who clicks any such link executes the attacker's JavaScript inside the patient browser origin, where patient form data is read before client-side encryption is applied. This breaks the project's central trust claim that the server is an untrusted relay and that administrators cannot read patient data. Patient-side encryption happens after form input, so JavaScript executing in the patient origin can read or alter the plaintext before encryption is performed. Version 1.0.2 fixes the issue."}], "source": {"advisory": "GHSA-xpr7-wx69-mp36", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-xpr7-wx69-mp36", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-07T14:31:37.016522Z", "id": "CVE-2026-48081", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T14:31:48.743Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48081", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-07T14:31:37.016522Z"}}}], "references": [{"url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-xpr7-wx69-mp36", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T14:29:35.674Z"}}], "cna": {"title": "OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer", "source": {"advisory": "GHSA-xpr7-wx69-mp36", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "open-reception", "product": "appointment-booking-software", "versions": [{"status": "affected", "version": "< 1.0.2"}]}], "references": [{"url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-xpr7-wx69-mp36", "name": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-xpr7-wx69-mp36", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/open-reception/appointment-booking-software/commit/98a107d4b4eaeab5cbb96ee0a28c2342b853eee0", "name": "https://github.com/open-reception/appointment-booking-software/commit/98a107d4b4eaeab5cbb96ee0a28c2342b853eee0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN can store `javascript:` URLs in the tenant `links` configuration (`website`, `imprint`, `privacyStatement`). These values are returned to the patient-facing landing page via `/api/public`, hydrated into the SvelteKit Button component, and rendered as `<a href=\"javascript:...\">` elements without URL-scheme filtering. A patient who clicks any such link executes the attacker's JavaScript inside the patient browser origin, where patient form data is read before client-side encryption is applied. This breaks the project's central trust claim that the server is an untrusted relay and that administrators cannot read patient data. Patient-side encryption happens after form input, so JavaScript executing in the patient origin can read or alter the plaintext before encryption is performed. Version 1.0.2 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-06T21:10:28.470Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48081", "state": "PUBLISHED", "dateUpdated": "2026-08-07T14:31:48.743Z", "dateReserved": "2026-05-20T18:40:45.830Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-06T21:10:28.470Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "appointment-booking-software", "vendor": "open-reception", "versions": [{"status": "affected", "version": "< 1.0.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN can store `javascript:` URLs in the tenant `links` configuration (`website`, `imprint`, `privacyStatement`). These values are returned to the patient-facing landing page via `/api/public`, hydrated into the SvelteKit Button component, and rendered as `<a href=\"javascript:...\">` elements without URL-scheme filtering. A patient who clicks any such link executes the attacker's JavaScript inside the patient browser origin, where patient form data is read before client-side encryption is applied. This breaks the project's central trust claim that the server is an untrusted relay and that administrators cannot read patient data. Patient-side encryption happens after form input, so JavaScript executing in the patient origin can read or alter the plaintext before encryption is performed. Version 1.0.2 fixes the issue."}, {"lang": "es", "value": "El software de reserva de citas de OpenReception proporciona una plataforma de reserva de citas con cifrado de extremo a extremo. Antes de la versi\u00f3n 1.0.2, un TENANT_ADMIN puede almacenar URLs \u2019javascript_disabled: \u2019 en la configuraci\u00f3n de \u2019links\u2019 del inquilino (\u2019website\u2019, \u2019imprint\u2019, \u2019privacyStatement\u2019). Estos valores son devueltos a la p\u00e1gina de destino orientada al paciente a trav\u00e9s de /api/public, hidratados en el componente SvelteKit Button, y renderizados como elementos \u201c<a href=\u201cjavascript_disabled: ...\u201d>\u201d sin filtrado de esquema de URL. Un paciente que hace clic en cualquiera de esos enlaces ejecuta el JavaScript del atacante dentro del origen del navegador del paciente, donde se leen los datos del formulario del paciente antes de que se aplique el cifrado del lado del cliente. Esto rompe la afirmaci\u00f3n central de confianza del proyecto de que el servidor es un rel\u00e9 no confiable y de que los administradores no pueden leer los datos del paciente. El cifrado del lado del paciente ocurre despu\u00e9s de la entrada del formulario, por lo que el JavaScript que se ejecuta en el origen del paciente puede leer o alterar el texto sin cifrar antes de que se realice el cifrado. La versi\u00f3n 1.0.2 corrige el problema."}], "id": "CVE-2026-48081", "lastModified": "2026-10-23T21:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48081", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-07T14:31:37.016522Z", "version": "2.0.3"}}]}, "published": "2026-08-06T22:17:10.850", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/open-reception/appointment-booking-software/commit/98a107d4b4eaeab5cbb96ee0a28c2342b853eee0"}, {"source": "security-advisories@github.com", "url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-xpr7-wx69-mp36"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-xpr7-wx69-mp36"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "appointment-booking-software", "source": "cna", "vendor": "open-reception"}, "product": "appointment-booking-software", "vendor": "open-reception"}], "created": "2026-08-07T00:45:04.370785+00:00", "updated": "2026-08-07T09:58:56.624858+00:00", "vendors": ["open-reception", "open-reception$PRODUCT$appointment-booking-software"]}