The vulnerability in OpenReception's appointment booking software (CVE-2026-48077) involves a missing authorization check in the GET API endpoint `/api/tenants/{id}/appointments/{appointmentId}` prior to version 1.1.0. While the DELETE handler properly enforces tenant-scoped permission checks, the GET handler does not call the required authorization function, allowing unauthorized access to appointment records if the UUID is known. The middleware chain does not compensate for this missing check, as the API paths bypass the auth guard and do not require tokens for non-admin paths. Version 1.1.0 addresses this issue by adding the necessary authorization checks.

An attacker who knows or obtains a valid appointment UUID can retrieve sensitive appointment information including channel and agent IDs, time, timezone, status, and encrypted payload components without authentication. This exposure is limited to information disclosure and does not allow modification or deletion of records. The CVSS score is 5.3 (medium severity) reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited confidentiality impact.

Upgrade to OpenReception appointment booking software version 1.1.0 or later, where the missing authorization check in the GET handler is implemented. Until upgrade, restrict access to appointment UUIDs and monitor for unauthorized access attempts. Patch status is confirmed by the vendor's versioning; no official advisory text is provided, so check vendor sources for updates.