CVE-2026-48081 is a CWE-79 cross-site scripting vulnerability in OpenReception's appointment booking software. Before version 1.0.2, tenant administrators can store javascript: URLs in tenant link configurations such as website, imprint, and privacyStatement. These URLs are returned via the /api/public endpoint and rendered directly into the patient-facing landing page as <a href="javascript:..."> elements without URL scheme filtering. When a patient clicks such a link, the attacker's JavaScript executes in the patient's browser context, allowing access to plaintext form data before client-side encryption is applied. This breaks the software's trust model that the server is untrusted and cannot read patient data. The vulnerability is fixed in version 1.0.2.

Exploitation allows a tenant administrator to inject JavaScript that executes in the patient's browser, enabling reading or modification of patient form data before encryption. This compromises confidentiality of sensitive patient data and undermines the software's security guarantees. The vulnerability requires user interaction (clicking a malicious link) and privileges of a TENANT_ADMIN to configure malicious links.

Upgrade to OpenReception appointment booking software version 1.0.2 or later, which fixes the vulnerability by properly filtering URL schemes in tenant link configurations. No other mitigations are indicated by the vendor advisory.