Cross-Tenant Invite Deletion in OpenReception

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANT_ADMIN deletes an existing staff user, the underlying `StaffService.deleteStaffMember()` runs an additional invite cleanup that deletes from the central `user_invite` table by email. The `email` clause has no `tenantId` predicate. Any pending invite in any tenant that shares the deleted staff's email is removed. A TENANT_ADMIN of tenant A who deletes a staff record with email `victim[@]example[.]com` also deletes the pending invite for `victim[@]example[.]com` in tenant B, even though they have no relationship to tenant B. The user-side delete is correctly scoped (`eq(user.id, staffId), eq(user.tenantId, tenantId)`), and the pending-invite-only delete path (when `staffId` is itself an invite ID) is also tenant-scoped. The bug is specifically in the invite cleanup that runs as a side effect of deleting an existing staff user. Version 1.0.6 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-48074

Affected Vendors & Products

Vendor	Product	Version / Range
openreception	appointment_booking_software	1.0.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability exists in OpenReception's appointment booking software before version 1.0.6. When a tenant admin deletes a staff user, the system incorrectly removes pending invites for that email across all tenants, not just the current one. This happens because the cleanup process lacks proper tenant isolation for the invite deletion.

Impact Analysis

An attacker with tenant admin access could delete a staff account using a victim's email address, causing unintended removal of pending invites for that victim in unrelated tenants. This could disrupt legitimate users' access to services or communications.

Mitigation Strategies

Upgrade OpenReception's appointment booking software to version 1.0.6 or later to patch the vulnerability. Ensure no pending invites are affected by staff deletions across tenants.

Hi! I’m here to help you understand CVE-2026-48074. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70