Live › vulnerability › CVE-2026-75524
Go to dashboardOpenReception's appointment booking software lets an attacker place several appointments into a single time slot that should be exclusive, by sending concurrent requests with one booking token. The result is a corrupted booking calendar and other clients being denied availability.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running OpenReception versions before 2.2.2 for appointment booking. The flaw sits in the booking insert path, so any deployment that accepts booking tokens from clients is in scope. Teams on or later are not affected.
2.2.2No product ranges from the sources yet.
2.2.22.2.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is designed to keep exclusive. The number of overlapping appointments equals the number of concurrent requests, and one booking token is enough because the token is consumed after the insert. This results in the integrity of the booking-calendar breaking and availability being denied to other clients. This issue has been patched in version 2.2.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-75524")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.