The vulnerability (CVE-2026-48077) in OpenReception's appointment booking software involves a missing authorization check in the GET API endpoint `/api/tenants/{id}/appointments/{appointmentId}` before returning appointment data. While the DELETE handler correctly enforces permission checks, the GET handler does not, allowing unauthorized access to appointment records including metadata and encrypted payload components. Middleware intended to enforce authentication does not protect this endpoint. The issue is resolved in version 1.1.0.

Unauthorized parties who know or obtain a valid appointment UUID can access appointment records containing channel and agent IDs, timestamps, status, and encrypted data components. This exposure may lead to information disclosure of appointment-related metadata. There is no indication of integrity or availability impact. The CVSS score is 5.3 (medium severity) reflecting the confidentiality impact without requiring privileges or user interaction.

Upgrade to OpenReception appointment booking software version 1.1.0 or later, where the missing authorization check in the GET handler is implemented. Prior versions lack this critical access control and should be considered vulnerable. No other mitigations are indicated.