The vulnerability in OpenReception appointment booking software involves the unauthenticated /api/tenants/{id}/schedule endpoint returning every non-archived channel for a tenant without respecting the channel's isPublic flag. Channels marked as private (isPublic = false) are intended to be hidden from public callers, but this endpoint discloses their sensitive metadata including names, descriptions, IDs, agent associations, pause status, confirmation requirements, and slot availability for the requested date range. The discrepancy between this endpoint and the addAppointmentToTunnel endpoint, which enforces the isPublic flag, confirms the design intent that private channels should be access-restricted. This flaw leads to exposure of sensitive information to unauthorized actors. The issue is resolved in version 1.0.5.

Unauthorized actors can retrieve sensitive metadata about private channels that are meant to be hidden, including channel names, descriptions, IDs, agent associations, and scheduling availability. This exposure could aid attackers in reconnaissance or unauthorized access attempts but does not directly impact data integrity or availability.

Upgrade OpenReception appointment booking software to version 1.0.5 or later, which patches the issue by enforcing the isPublic flag on the /api/tenants/{id}/schedule endpoint. No other mitigation is indicated by the vendor advisory.