CVE-2026-75524: OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is designed to keep exclusive. The number of overlapping appointments equals the number of concurrent requests, and one booking token is enough because the token is consumed after the insert. This results in the integrity of the booking-calendar breaking and availability being denied to other clients. This issue has been patched in version 2.2.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenReceptionto a version that resolves this vulnerability.Fixed in 2.2.2
Event History
Frequently Asked Questions
Which deployments are affected?
OpenReception versions prior to 2.2.2 are affected. Version 2.2.2 contains the patch.
What does an attacker need to exploit this issue?
The attacker needs one booking token and the ability to submit concurrent booking requests. The token is consumed only after the appointment insert, allowing each concurrent request to create an appointment for the same slot.
What is the practical impact of successful exploitation?
An attacker can create as many overlapping appointments for an agent's supposedly exclusive time slot as there are concurrent requests. This breaks calendar integrity and can deny legitimate clients the ability to book that agent.