{"id":"CVE-2026-75524","kind":"vulnerability","aliases":["CVE-2026-75524"],"related":[],"title":"OpenReception: concurrent booking requests overbook one appointment time slot","description":"OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is designed to keep exclusive. The number of overlapping appointments equals the number of concurrent requests, and one booking token is enough because the token is consumed after the insert. This results in the integrity of the booking-calendar breaking and availability being denied to other clients. This issue has been patched in version 2.2.2.","summary":"OpenReception's appointment booking software lets an attacker place several appointments into a single time slot that should be exclusive, by sending concurrent requests with one booking token. The result is a corrupted booking calendar and other clients being denied availability.","severity":"medium","cvss":5.4,"epss":0.00313,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["appointment-booking","openreception","package","self-hosted"],"not_affected_if":["version-2.2.2-or-later"],"how_to_check":"- Check the installed OpenReception version and confirm it is below `2.2.2`\n- unknown","fix":"- Upgrade OpenReception to `2.2.2` or later","status":"open","published_at":"2026-10-23T21:17:25+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","triaged_at":"2026-10-25T04:14:10+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:14:10Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenReception to `2.2.2` or later","reach":"internet","title":"OpenReception: concurrent booking requests overbook one appointment time slot","impact":"medium","summary":"OpenReception's appointment booking software lets an attacker place several appointments into a single time slot that should be exclusive, by sending concurrent requests with one booking token. The result is a corrupted booking calendar and other clients being denied availability.","category":"package","nicknames":[],"who_cares":["openreception","appointment-booking","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Overlapping bookings corrupt the calendar and deny availability to others","analyst_note":"","how_to_check":"- Check the installed OpenReception version and confirm it is below `2.2.2`\n- unknown","needs_analyst":false,"not_affected_if":["version-2.2.2-or-later"],"who_is_affected":"Teams running OpenReception versions before `2.2.2` for appointment booking. The flaw sits in the booking insert path, so any deployment that accepts booking tokens from clients is in scope. Teams on `2.2.2` or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000559,"input_tokens":3382,"output_tokens":441,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-75524':12A,15A '2.2.2':83C,155C 'agent':88C 'appoint':7A,17B,26B,34B,67C,77C,91C,109C 'appointment-book':16B 'attack':31B,85C 'avail':64B,142C 'book':3A,18B,27B,50B,57B,68C,78C,118C,138C 'booking-calendar':137C 'break':140C 'calendar':58B,139C 'client':61B,147C 'concurr':2A,46B,114C 'consum':126C 'corrupt':56B 'cve':10A,13A 'deni':63B,144C 'design':101C 'encrypt':76C 'end':73C,75C 'end-to-end':72C 'enough':121C 'equal':110C 'exclus':43B,104C 'host':23B 'insert':129C 'integr':134C 'issu':149C 'keep':103C 'let':29B 'multipl':90C 'number':106C,112C 'one':6A,49B,117C 'openrecept':1A,19B,24B,65C 'overbook':5A,86C 'overlap':108C 'packag':20B 'patch':152C 'place':32B,89C 'platform':79C 'prior':80C 'provid':70C 'request':4A,47B,115C 'result':53B,131C 'self':22B 'self-host':21B 'send':45B 'sever':33B 'singl':37B,94C 'slot':9A,39B,96C 'softwar':28B,69C 'system':99C 'time':8A,38B,95C 'token':51B,119C,124C 'version':82C,154C","nicknames":[],"mitigations":[],"who_affected":"Teams running OpenReception versions before `2.2.2` for appointment booking. The flaw sits in the booking insert path, so any deployment that accepts booking tokens from clients is in scope. Teams on `2.2.2` or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T21:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-75524","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75524","severity":null,"published_at":"2026-10-23T21:17:25+00:00","modified_at":"2026-10-23T21:17:25+00:00","first_seen_at":"2026-10-23T21:57:34+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null},{"source":"epss","external_id":"CVE-2026-75524","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-75524","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}