OpenReception's appointment booking software before version 1.0.4 contains a missing authorization vulnerability (CWE-862) in the POST /api/tenants/{tenantId}/staff/{staffId}/crypto endpoint. This endpoint accepts and stores attacker-controlled ML-KEM-768 public keys without authentication, allowing an unauthenticated network attacker to register as an additional encryption recipient for any tenant's appointments. The vulnerability includes a logging bypass where omission of the email field and absence of a registration cookie causes the system to treat the request as legitimate, suppressing the unauthorized warning. The staff_crypto table lacks unique constraints on user_id, allowing multiple attacker keys per staffId, which need not correspond to valid users. Weak schema validation permits malformed cryptographic keys. The attacker-controlled keys are returned by the public booking API and used to encrypt appointment tunnel keys, enabling the attacker to decrypt appointment payloads. Version 1.0.4 patches this vulnerability.

An unauthenticated attacker can inject their own encryption keys into the system for any tenant, breaking the end-to-end encryption model by becoming a co-recipient of encrypted appointment data. This allows the attacker to decrypt sensitive patient appointment information, violating confidentiality. The vulnerability also undermines logging and monitoring by suppressing unauthorized access warnings, increasing the risk of undetected exploitation. Additionally, weak validation of cryptographic keys can disrupt legitimate booking operations.

Version 1.0.4 of OpenReception's appointment booking software patches this vulnerability. Users should upgrade to version 1.0.4 or later to remediate the issue. No other mitigations are indicated or necessary once the patch is applied.