CVE-2026-48077

OpenReception’s appointment-booking software exposes a specific GET endpoint that returns full appointment records without authorization prior to version 1.1.0. The affected path is GET /api/tenants/{id}/appointments/{appointmentId}, which can disclose tenant-scoped records, including channel and...