CVE-2026-75525: CWE-863: Incorrect Authorization in open-reception appointment-booking-software

CVE-2026-75525 is an incorrect authorization vulnerability (CWE-863) in OpenReception's appointment booking software (versions <=2.1.0). An unauthenticated remote attacker can store an arbitrary ML-KEM-768 public key under any existing user's identity in any tenant's staff-crypto recipient directory. This recipient directory is intended to be immutable by attackers and even administrators, ensuring that appointment data remains end-to-end encrypted to authorized staff only. However, this flaw allows the attacker to inject a malicious recipient key that receives the tunnel key for every subsequent appointment booked in that tenant, granting persistent unauthorized access to encrypted appointment data. At the time of publication, no patches or fixes are publicly available.

The vulnerability allows an unauthenticated attacker to become a persistent unauthorized recipient of encryption keys for appointment data, undermining the confidentiality guarantees of the end-to-end encryption system. While the CVSS score is medium (5.3) with no direct confidentiality impact indicated, the integrity of the recipient directory is compromised, potentially enabling unauthorized data access.

No official patches or fixes are currently available for this vulnerability. Users should monitor vendor communications for updates and consider restricting access or usage of affected versions until a fix is released. Since this is a design flaw allowing unauthorized key injection, temporary mitigations may be limited.