PT-2026-68739

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.1.0 Description The GET handler at the endpoint /api/tenants/id/appointments/appointmentId fails to perform authorization checks. This allows any party with a valid appointment UUID to retrieve the full...

CVE-2026-48077: Missing Authorization

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at /api/tenants/id/appointments/appointmentId performs no authorization check before returning the appointment record. Any party who knows or obtains...

Panic in `libcrux-psq` on decryption of malformed AES-GCM ciphertext

The latest releases of the libcrux-psq crate contains the following bug-fix: 1319: Propagate AEADError instead of panicking The issue fixed in 1319 was first reported by Nadim Kobeissi...