OpenReception's appointment booking software versions 1.0.1 and prior have an incorrect authorization vulnerability (CWE-863) in the new-client booking flow. The booking access token issued after a proof-of-work challenge does not bind to the channelId, and the create-new-client function only verifies that the channel is not archived but does not check if the channel is public. This allows an attacker who completes the bootstrap flow to submit a create-new-client request with a private channelId, resulting in confirmed or new appointments in private channels. The private channel IDs can be obtained unauthenticated from another endpoint, making private channels accessible to anonymous attackers. No known patches or fixes are available at the time of publication.

An attacker can bypass intended access controls to create appointments in private channels of the OpenReception appointment booking software. This unauthorized access could lead to appointment manipulation or disruption in private channels. The vulnerability does not impact confidentiality but affects integrity and availability of the appointment booking system. The CVSS score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact on integrity and availability.

No official patches or fixes are currently available for this vulnerability. Users should monitor vendor advisories for updates. Until a fix is released, restricting access to the scheduling endpoints and implementing additional access controls or rate limiting may help reduce exposure. Note that the vendor has not provided any official remediation guidance or temporary fixes at this time.