The vulnerability in OpenReception appointment booking software involves the unauthenticated /api/tenants/{id}/schedule endpoint returning all non-archived channels for a tenant without respecting the isPublic flag. Private channels, which are intended to be hidden from public callers, are disclosed with sensitive metadata including channel names, descriptions, IDs, agent associations, pause status, confirmation requirements, and computed slot availability. This exposure violates the intended access control design, where private channels should not be visible in the schedule endpoint. The flaw was corrected in version 1.0.5 by enforcing proper filtering of channels based on their isPublic status.

An unauthenticated attacker can retrieve sensitive information about private channels that are meant to be hidden from public view. This includes metadata that could reveal internal services, agent associations, and scheduling details. While this does not allow modification or denial of service, it leaks confidential operational information that could aid further reconnaissance or targeted attacks.

Upgrade to OpenReception appointment booking software version 1.0.5 or later, where the schedule endpoint properly enforces the isPublic flag to restrict disclosure of private channels. No other mitigation is indicated as the issue is fixed in this version.