The vulnerability (CVE-2026-48088) in OpenReception's appointment booking software is a missing authorization (CWE-862) in the POST /api/tenants/{tenantId}/staff/{staffId}/crypto endpoint prior to version 1.0.4. Unauthenticated attackers can submit and store attacker-controlled ML-KEM-768 public keys for any tenant without authentication. Although a warning log is generated when no session or registration cookie is present, the system still inserts the malicious keys. A second variant bypasses the warning by exploiting an optional email field, causing the system to treat the request as legitimate. The staff_crypto table lacks unique constraints, allowing multiple attacker keys per staff ID. The weak schema validation permits malformed cryptographic keys, compounding the issue. The attacker-controlled keys are returned by the public booking API and used to encrypt appointment tunnel keys, enabling attackers to decrypt all appointment payloads for bookings they target. Version 1.0.4 fixes this authorization bypass.

An unauthenticated network attacker can register themselves as an encryption recipient for any tenant's future patient appointments, breaking the platform's end-to-end encryption guarantees. This allows the attacker to decrypt sensitive appointment data, compromising confidentiality and privacy. The vulnerability also enables injection of malformed cryptographic keys that may disrupt legitimate booking flows. The flaw affects the confidentiality and integrity of appointment information with low attack complexity and no required privileges.

Version 1.0.4 of OpenReception appointment booking software patches this missing authorization vulnerability. Users should upgrade to version 1.0.4 or later to remediate the issue. No vendor advisory is provided to indicate alternative mitigations or temporary fixes. Until patched, monitoring for unauthorized crypto key insertions may help detect exploitation attempts, but the vulnerability allows suppression of warning logs, reducing detection reliability.