CVE-2026-48081

{
  "id": "CVE-2026-48081",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-06T22:17:10.850",
  "lastModified": "2026-10-23T21:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN can store `javascript:` URLs in the tenant `links` configuration (`website`, `imprint`, `privacyStatement`). These values are returned to the patient-facing landing page via `/api/public`, hydrated into the SvelteKit Button component, and rendered as `<a href=\"javascript:...\">` elements without URL-scheme filtering. A patient who clicks any such link executes the attacker's JavaScript inside the patient browser origin, where patient form data is read before client-side encryption is applied. This breaks the project's central trust claim that the server is an untrusted relay and that administrators cannot read patient data. Patient-side encryption happens after form input, so JavaScript executing in the patient origin can read or alter the plaintext before encryption is performed. Version 1.0.2 fixes the issue."
    },
    {
      "lang": "es",
      "value": "El software de reserva de citas de OpenReception proporciona una plataforma de reserva de citas con cifrado de extremo a extremo. Antes de la versión 1.0.2, un TENANT_ADMIN puede almacenar URLs ’javascript_disabled: ’ en la configuración de ’links’ del inquilino (’website’, ’imprint’, ’privacyStatement’). Estos valores son devueltos a la página de destino orientada al paciente a través de /api/public, hidratados en el componente SvelteKit Button, y renderizados como elementos “<a href=“javascript_disabled: ...”>” sin filtrado de esquema de URL. Un paciente que hace clic en cualquiera de esos enlaces ejecuta el JavaScript del atacante dentro del origen del navegador del paciente, donde se leen los datos del formulario del paciente antes de que se aplique el cifrado del lado del cliente. Esto rompe la afirmación central de confianza del proyecto de que el servidor es un relé no confiable y de que los administradores no pueden leer los datos del paciente. El cifrado del lado del paciente ocurre después de la entrada del formulario, por lo que el JavaScript que se ejecuta en el origen del paciente puede leer o alterar el texto sin cifrar antes de que se realice el cifrado. La versión 1.0.2 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "open-reception",
          "product": "appointment-booking-software",
          "versions": [
            {
              "version": "< 1.0.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.7,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T14:31:37.016522Z",
          "id": "CVE-2026-48081",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/open-reception/appointment-booking-software/commit/98a107d4b4eaeab5cbb96ee0a28c2342b853eee0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-xpr7-wx69-mp36",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-xpr7-wx69-mp36",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}