{"id":"CVE-2026-75525","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-75525","generatedAt":"2026-10-28T02:21:35.048Z","title":"In versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 public key under any existing user's identity in any tenant's staff-crypto recipient directory.","description":"OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 public key under any existing user's identity in any tenant's staff-crypto recipient directory. The product's design guarantees that appointment data is end-to-end encrypted to staff members and that the staff recipient directory is not attacker-writable, so that even administrators and the operator cannot read patient data. This endpoint breaks that guarantee for an unauthenticated remote actor: it allows writing an arbitrary encryption recipient into the recipient directory of any tenant. The injected key receives the tunnel key of every appointment booked afterward in that tenant, because booking clients encrypt to all active staff keys. The attacker holds the corresponding secret key and is a persistent, unauthorized recipient of that key material. At time of publication, there are no publicly available patches.","published":"2026-10-23T21:17:25.000Z","lastModified":"2026-10-26T13:48:07.000Z","status":"Deferred","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},"cwe":["CWE-863"],"affected":[],"epss":{"score":0.00121,"percentile":0.01888,"date":"2026-10-26","history":[{"date":"2026-10-24","score":0.00194,"percentile":0.08591}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.12%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-23T21:17:25.000Z","detail":{"score":"5.3","severity":"MEDIUM","publishedAt":"2026-10-23T21:17:25.150Z"},"summary":"New CVE, medium severity (CVSS 5.3)."}],"references":[{"url":"https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-qc72-9fg9-h66h","source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-75525","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}