The vulnerability (CVE-2026-48081) in OpenReception appointment booking software involves improper neutralization of input during web page generation (CWE-79). Specifically, tenant administrators can store javascript: URLs in tenant link configurations (website, imprint, privacyStatement). These URLs are returned via the /api/public endpoint and rendered as <a href="javascript:..."> elements without filtering the URL scheme. When a patient clicks such a link, attacker-controlled JavaScript executes in the patient's browser context, allowing access to patient form data before client-side encryption is applied. This breaks the software's trust model that assumes the server is untrusted and patient data is encrypted before transmission. The issue is fixed in version 1.0.2.

Exploitation allows a tenant administrator to inject JavaScript that executes in the patient browser origin, enabling reading or modification of patient form data before client-side encryption. This compromises confidentiality and integrity of sensitive patient data. The vulnerability does not affect availability. The CVSS 3.1 score is 8.1 (High), reflecting network attack vector, low attack complexity, high privileges required (TENANT_ADMIN), user interaction required, scope change, and high impact on confidentiality and integrity.

Upgrade to OpenReception appointment booking software version 1.0.2 or later, where this vulnerability is fixed. There is no indication of alternative mitigations or temporary workarounds. Patch status is not explicitly stated but the fix is in version 1.0.2. No vendor advisory content is provided, so verify with the vendor for official remediation guidance.