OpenReception appointment-booking-software up to 1.0.1 /api/log neutralization for logs

Summaryinfo

A vulnerability was found in OpenReception appointment-booking-software up to 1.0.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/log. This manipulation causes neutralization for logs. This vulnerability is tracked as CVE-2026-48083. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in OpenReception appointment-booking-software up to 1.0.1. It has been declared as critical. Affected by this vulnerability is an unknown function of the file /api/log. The manipulation with an unknown input leads to a neutralization for logs vulnerability. The CWE definition for the vulnerability is CWE-117. The product does not neutralize or incorrectly neutralizes output that is written to logs. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the `/api/log` endpoint accepts unauthenticated POST requests, applies no schema validation to the message body, writes attacker-controlled content directly into the application's stdout log, interprets newline characters as real line breaks, and enforces no size or rate limits. Three independent abuse modes follow: log injection (forge log lines that look like legitimate system events), log volume DoS (saturate the logging pipeline at sustained 100+ requests per second of small messages), and oversized-payload submission (100 KB payloads accepted; larger sizes not tested). The most operationally damaging mode is log injection. An attacker can inject lines that an operator scanning logs would mistake for real system errors, mask their own activity behind fake noise, or pollute SIEM alerting rules with crafted false positives. A line such as `[error]: injected admin error` injected from an unauthenticated source is indistinguishable from the application's own error output once written to disk. Version 1.0.2 fixes the issue.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-48083 since 05/20/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.0.2 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Appointment Software

Vendor

• OpenReception

Name

• appointment-booking-software

Version

• 1.0.0
• 1.0.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion