The vulnerability causes the /api/tenants/{id}/schedule endpoint to return all non‑archived channels for a tenant, including those marked isPublic = false, along with channel names, descriptions, IDs, agent associations, pause status, confirmation requirements, and computed slot availability. Based on the description, it is inferred that the endpoint can be accessed without authentication and that any remote user can supply a tenant ID to retrieve channel data. This disclosure allows an unauthenticated caller to learn details about internal‑only services that were intended to be hidden, potentially exposing sensitive organizational information and enabling further exploitation. The weakness is a classic information‑disclosure (CWE‑200) that permits exposure of private data to the public.

Providers of OpenReception appointment‑booking‑software versions older than 1.0.5 are affected. The schedule endpoint exposed by the product returns private channel data for any tenant, making any installation running a pre‑1.0.5 release vulnerable. The vulnerability is present in all deployments that use the default endpoint without additional access controls.

The CVSS score of 5.3 indicates a medium severity impact. Based on the description, it is inferred that an attacker can exploit the vulnerability by sending unauthenticated HTTP requests over the network to the /api/tenants/{id}/schedule endpoint using a known or guessed tenant ID, therefore no special privileges are required. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, suggesting that the breach likelihood may be moderate but not yet observed in the wild. Once the data is disclosed, an attacker could map internal services, gather agent details, or potentially schedule appointments in private channels if additional weaknesses exist.