CVE-2026-48080

Received Received - Intake

PostgreSQL Credential Disclosure in OpenReception

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the `GET /api/tenants/{id}` endpoint returns the full tenant record to any authenticated `TENANT_ADMIN` of that tenant, including the `databaseUrl` field. This field contains the live PostgreSQL connection string the application uses to connect to that tenant's database. In the tested official `docker-compose.prod.yml` deployment, the connection string contained the user `postgres` with `rolsuper=true` and the plaintext password from `secrets/postgres_password.txt`. Operators who configure a non-superuser PostgreSQL user via `secrets/postgres_user.txt` would expose a less privileged credential, but the disclosure of the connection string itself is independent of that choice. The same credential applies to every database managed by that PostgreSQL instance: the central `appointment_booking` database, every per-tenant database (one per tenant), and the postgres administrative database. A `TENANT_ADMIN` of one tenant who can reach `postgres:5432` (directly via internal network, indirectly via any SSRF, RCE, or file-read in the application) can read every other tenant's appointment ciphertexts, key shares, and metadata; read the central user table, including all `GLOBAL_ADMIN` accounts, password hashes, and session records; modify or delete any data in any tenant database; and/or i a superuser-scoped deployment: use PostgreSQL's `pg_read_server_files`, `COPY ... FROM PROGRAM`, and `CREATE EXTENSION` for further escalation inside the database container. This breaks the per-tenant database isolation that is otherwise the primary cross-tenant control in the application. The application code carefully scopes most queries to the calling tenant's database, but those scopings are irrelevant once the attacker holds the credentials that bypass the application entirely. Version 1.0.2 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-48080

Affected Vendors & Products

Vendor	Product	Version / Range
openreception	appointment_booking	1.0.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in OpenReception's appointment booking software (before version 1.0.2) allows a TENANT_ADMIN user to access sensitive database connection details via the GET /api/tenants/{id} endpoint. The exposed databaseUrl field contains a PostgreSQL connection string with superuser credentials, enabling unauthorized access to all tenant data and central user records.

Detection Guidance

Check for unauthorized access to the PostgreSQL port (5432) from internal or external networks. Inspect logs for unusual queries or connections to tenant databases. Verify if the /api/tenants/{id} endpoint exposes the databaseUrl field in responses.

Impact Analysis

An attacker with TENANT_ADMIN access could read or modify all tenant appointment data, steal user credentials including GLOBAL_ADMIN accounts, escalate privileges within the database container, or potentially gain control over the entire system by exploiting PostgreSQL features.

Compliance Impact

This vulnerability severely compromises data confidentiality and integrity, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. The exposure of all tenant data and administrative credentials represents a critical compliance failure.

Mitigation Strategies

Upgrade to version 1.0.2 or later to fix the endpoint exposure. Rotate all PostgreSQL credentials, especially superuser accounts. Restrict network access to PostgreSQL port 5432. Review and remove any exposed databaseUrl values from logs or responses.

Hi! I’m here to help you understand CVE-2026-48080. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70