PT-2026-68740

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.5 Description The unauthenticated '/api/tenants/id/schedule' endpoint returns all non-archived channels for a tenant, ignoring the isPublic flag. This allows the disclosure of private channels intended to be...

CVE-2026-48078: Exposure of Sensitive Information to an Unauthorized Actor

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticated /api/tenants/id/schedule endpoint returns every non-archived channel for a tenant regardless of the channel's isPublic flag. Channels marked...