CVE-2026-75524
OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent
Fetching some sources has been requested. Reload in about a minute to see them.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 3.1 vector| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | L | Low (easy) |
| Privileges required PR | L | Regular user |
| User interaction UI | N | None |
| Scope S | U | Unchanged |
| Confidentiality C | N | None |
| Integrity I | L | Low |
| Availability A | L | Low |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Description
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is designed to keep exclusive. The number of overlapping appointments equals the number of concurrent requests, and one booking token is enough because the token is consumed after the insert. This results in the integrity of the booking-calendar breaking and availability being denied to other clients. This issue has been patched in version 2.2.2.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / [email protected] (Secondary) | 3.1 | 5.4 MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
| CNA / GitHub_M | 3.1 | 5.4 MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| open-reception | appointment-booking-software | affected: < 2.2.2 |
Linux distribution status
References (3)
- https://github.com/open-reception/appointment-booking-software/commit/73663288a8d4ad2ad31d897dc1f494ace2f0e452 NVD, CNA x_refsource_MISC
- https://github.com/open-reception/appointment-booking-software/releases/tag/v2.2.2 NVD, CNA x_refsource_MISC
- https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-q452-m9pf-qj9j NVD, CNA x_refsource_CONFIRM