CVE-2026-48074 open-reception CVE debrief

Who should care

Administrators and users of OpenReception's appointment booking software, especially those managing staff and tenant configurations, should be aware of this vulnerability. Applying version 1.0.6 or later is recommended to mitigate the issue.

Technical summary

The OpenReception appointment booking software has a vulnerability in versions prior to 1.0.6. When a TENANT_ADMIN deletes a staff user, the `StaffService.deleteStaffMember()` method triggers an invite cleanup that deletes pending invites in any tenant sharing the deleted staff's email. This occurs because the `email` clause in the invite cleanup lacks a `tenantId` predicate, leading to unintended deletion of invites across tenants.

Defensive priority

CVE-2026-48074 is rated with a CVSS score of 2.7 and a LOW severity. The vulnerability affects OpenReception's appointment booking software, specifically versions prior to 1.0.6. A TENANT_ADMIN can delete an existing staff user, which triggers an invite cleanup that inadvertently deletes pending invites in other tenants sharing the same email. Defensive priorities include verifying and restricting administrative access, ensuring proper tenant isolation, and monitoring for unusual invite deletion activity.

Recommended defensive actions

• Verify and restrict administrative access to the appointment booking software.
• Ensure proper tenant isolation in the software configuration.
• Monitor for unusual invite deletion activity.
• Apply version 1.0.6 or later of the OpenReception appointment booking software.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE description details that OpenReception's appointment booking software has a vulnerability in versions prior to 1.0.6. When a TENANT_ADMIN deletes a staff user, the `StaffService.deleteStaffMember()` method performs an additional invite cleanup. This cleanup deletes from the central `user_invite` table by email without a `tenantId` predicate, affecting pending invites in any tenant that shares the deleted staff's email. The bug is isolated to the invite cleanup side effect of deleting an existing staff user. Evidence is based on the CVE description and related references.

Official resources