CVE-2026-48086

Received Received - Intake

Privilege Escalation in OpenReception Appointment Software

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN promotes themselves to platform-wide GLOBAL_ADMIN through a single PUT request. The role-update handler accepts the `GLOBAL_ADMIN` enum value from any tenant admin updating their own tenant's staff. No policy check enforces that "only an existing GLOBAL_ADMIN may grant GLOBAL_ADMIN", so the schema validation IS the authorization decision. After re-login, the JWT contains the new role and the formerly-tenant-scoped admin reaches every other tenant on the platform. On the hosted OpenReception service this is a scope-changed escalation: a single customer-side tenant administrator gains full platform-wide administrative control over all other tenants' configuration, users, staff records, operational metadata, and tenant lifecycle. Plaintext appointment contents remain subject to the E2E model unless chained with the staff-crypto poisoning issue (V-4) or with staff-passkey hijacking (V-1). On a single-tenant self-hosted deployment it is still a privilege escalation because TENANT_ADMIN should not be able to create new tenants, modify global configuration, or manage other administrators. The same handler also accepts updates targeted at any colleague within the tenant. A tenant admin can promote a separate collaborator account instead of themselves, leaving their own audit trail clean while the platform-wide breach happens through a separate identity. Version 1.0.2 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-48086

Affected Vendors & Products

Vendor	Product	Version / Range
openreception	appointment_booking_software	1.0.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability allows a TENANT_ADMIN to escalate their privileges to GLOBAL_ADMIN by sending a single PUT request. The system does not verify if the requester is authorized to grant this role, relying only on schema validation. After re-login, the attacker gains full platform-wide control over all tenants' data and configurations.

Detection Guidance

Check OpenReception software version for installations prior to 1.0.2. Review admin role assignments in logs for unauthorized GLOBAL_ADMIN promotions via PUT requests. Inspect JWT tokens after login for unexpected role escalations.

Impact Analysis

An attacker with TENANT_ADMIN access can take over the entire platform, accessing and modifying all tenants' data, user records, and configurations. This includes sensitive information like appointment details and operational metadata. The impact ranges from data breaches to full system compromise.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control, such as GDPR's principle of least privilege and HIPAA's access control safeguards. Unauthorized privilege escalation could lead to unauthorized access to sensitive personal or health data, resulting in legal and regulatory penalties.

Mitigation Strategies

Upgrade OpenReception appointment booking software to version 1.0.2 or later immediately. Review all admin accounts for unauthorized role changes. Audit recent admin activity logs for suspicious GLOBAL_ADMIN promotions.

Hi! I’m here to help you understand CVE-2026-48086. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70