---
id: "CVE-2026-75524"
kind: "vulnerability"
aliases: ["CVE-2026-75524"]
title: "OpenReception: concurrent booking requests overbook one appointment time slot"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["appointment-booking", "openreception", "package", "self-hosted"]
not_affected_if: ["version-2.2.2-or-later"]
published_at: "2026-10-23T21:17:25+00:00"
first_seen_at: "2026-10-23T21:57:34+00:00"
updated_at: "2026-10-25T04:14:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75524", "first_seen_at": "2026-10-23T21:57:34+00:00"}]
---

# OpenReception: concurrent booking requests overbook one appointment time slot

OpenReception's appointment booking software lets an attacker place several appointments into a single time slot that should be exclusive, by sending concurrent requests with one booking token. The result is a corrupted booking calendar and other clients being denied availability.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenReception version and confirm it is below `2.2.2`
- unknown

## Fix

- Upgrade OpenReception to `2.2.2` or later

## Timeline

- 2026-10-23T21:57:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-75524

## From the sources

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is designed to keep exclusive. The number of overlapping appointments equals the number of concurrent requests, and one booking token is enough because the token is consumed after the insert. This results in the integrity of the booking-calendar breaking and availability being denied to other clients. This issue has been patched in version 2.2.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_