OpenReception’s appointment booking platform allows an attacker who knows a valid appointment UUID to retrieve the entire appointment record through a GET request at /api/tenants/{id}/appointments/{appointmentId}. The endpoint returns sensitive fields such as channel and agent identifiers, time, timezone, status, and cryptographic components of an encrypted payload. This is a missing authorization failure (CWE‑862) that enables information disclosure without authentication or permission checks, while the DELETE handler correctly performs a permission check. The vulnerability does not permit alteration or execution; it solely allows read‑only data exposure. According to the CVSS score of 5.3, the impact is moderate, reflecting partial confidentiality compromise.

The flaw exists in the OpenReception appointment booking software, affecting all versions prior to 1.1.0. No other vendor or product is listed as impacted.

The vulnerability can be triggered by sending an unauthenticated HTTP GET request to the vulnerable endpoint with a valid appointment UUID. Because the request does not require any token and the API bypasses the authentication guard, an attacker only needs network access to the API or a public URL. The EPSS score is unavailable, and the issue is not currently listed in CISA’s KEV catalog. Given the CVSS score of 5.3, the risk is moderate, but the ease of exploitation and the sensitivity of the data mean that remedial action should be taken promptly.