The vulnerability resides in OpenReception’s appointment booking platform. The API endpoint designed for adding appointments to a client’s tunnel, add-to-tunnel, performs only a basic existence check on the provided tunnel identifier and email hash. No authentication or session validation is made, allowing any requester to create a confirmed appointment with attacker‑controlled data, including ciphertext fields, date, duration, and agent. Because the endpoint does not verify that the caller owns the tunnel, an attacker can inject appointments into any tunnel belonging to any tenant. This flaw falls under incomplete authorization (CWE-862). The result is the ability to create, modify, or inject appointments without user consent, potentially disrupting tenant schedules.

The affected product is OpenReception appointment booking software supplied by the vendor open-reception, any installation prior to version 1.0.5 of the application. The flaw is present on the add-to-tunnel endpoint, which accepts valid tunnel identifiers and email hashes from any client. No other products or versions are listed as impacted.

The impact is moderate with a CVSS score of 6.5. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by sending an unauthenticated HTTP request to the add-to-tunnel endpoint with a known tunnelId and any valid emailHash. The lack of authentication or authorization checks makes exploitation trivial for anyone who can reach the endpoint. This makes the vulnerability relatively low cost to attack, but the scope includes all clients relying on the affected endpoint.