CVE-2026-48075 is a missing authorization vulnerability (CWE-862) in OpenReception's appointment booking software before version 1.0.5. The `add-to-tunnel` endpoint permits unauthenticated users to insert confirmed appointments into any client tunnel by providing any valid tunnelId and emailHash, which need not be linked. The endpoint validates only the existence of the emailHash but does not verify ownership or require any session, authorization header, access token, or proof of work. This allows arbitrary appointment creation with attacker-controlled data fields, including ciphertext, date, duration, and agent. The vulnerability is fixed in version 1.0.5.

An attacker can create arbitrary confirmed appointments in any client tunnel without authentication, potentially disrupting appointment schedules or injecting malicious data. The vulnerability does not disclose sensitive data but allows unauthorized modification of appointment records, impacting data integrity and availability. There is no indication of confidentiality loss or denial of service beyond limited availability impact. No known exploits are reported in the wild.

Upgrade OpenReception appointment booking software to version 1.0.5 or later, where the `add-to-tunnel` endpoint requires proper authorization. Until upgrade, restrict access to the vulnerable endpoint if possible. Patch status is not explicitly confirmed in vendor advisories; therefore, verify with the vendor for official remediation guidance.