{"id":"CVE-2026-48081","summary":"OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer","details":"OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN can store `javascript:` URLs in the tenant `links` configuration (`website`, `imprint`, `privacyStatement`). These values are returned to the patient-facing landing page via `/api/public`, hydrated into the SvelteKit Button component, and rendered as `\u003ca href=\"javascript:...\"\u003e` elements without URL-scheme filtering. A patient who clicks any such link executes the attacker's JavaScript inside the patient browser origin, where patient form data is read before client-side encryption is applied. This breaks the project's central trust claim that the server is an untrusted relay and that administrators cannot read patient data. Patient-side encryption happens after form input, so JavaScript executing in the patient origin can read or alter the plaintext before encryption is performed. Version 1.0.2 fixes the issue.","aliases":["GHSA-xpr7-wx69-mp36"],"modified":"2026-08-08T03:47:58.225223985Z","published":"2026-08-06T21:10:28.470Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48081.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-79"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48081.json"},{"type":"ADVISORY","url":"https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-xpr7-wx69-mp36"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48081"},{"type":"FIX","url":"https://github.com/open-reception/appointment-booking-software/commit/98a107d4b4eaeab5cbb96ee0a28c2342b853eee0"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/open-reception/appointment-booking-software","events":[{"introduced":"0"},{"fixed":"98a107d4b4eaeab5cbb96ee0a28c2342b853eee0"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.0.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.0.1","v1.0.0","v1.0.0-rc2","v1.0.0-rc"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48081.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N"}]}