All vulnerabilities
CVE-2026-75524GHSA-q452-m9pf-qj9j

appointment-booking-software: OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent

open-reception appointment-booking-software
Open in ThreatlineRecord JSON
CVSS
5.4Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is designed to keep exclusive. The number of overlapping appointments equals the number of concurrent requests, and one booking token is enough because the token is consumed after the insert. This results in the integrity of the booking-calendar breaking and availability being denied to other clients. This issue has been patched in version 2.2.2.

Text from CVE List

Affected versions 2

  • appointment-booking-softwareaffected: < 2.2.2CVE List
  • appointment-booking-software<= 2.1.0GitHub

References 3