CVE-2026-48074 open-reception CVE debrief

Who should care

Tenant administrators and security teams responsible for OpenReception's appointment booking software should assess exposure and apply the patch to prevent unintended invite removal across tenants.

Why it matters

CVE-2026-48074 is a low-severity vulnerability in OpenReception's appointment booking software that can result in unintended invite removal across tenants. Defenders should prioritize verifying and applying the patch to prevent this issue.

• Unintended removal of pending invites across tenants
• Potential data loss or corruption due to invite removal
• Increased risk of phishing or social engineering attacks due to invite removal

Technical summary

The vulnerability is caused by the `StaffService.deleteStaffMember()` method running an additional invite cleanup that deletes from the central `user_invite` table by email without a `tenantId` predicate. This results in pending invites being removed across all tenants that share the deleted staff's email. The issue was patched in version 1.0.6. The bug is specifically in the invite cleanup that runs as a side effect of deleting an existing staff user. The user-side delete is correctly scoped, and the pending-invite-only delete path is also tenant-scoped.

Defensive priority

Defenders should prioritize verifying and applying the patch to prevent unintended invite removal across tenants.

Recommended defensive actions

• Verify and apply the patch to prevent unintended invite removal across tenants.
• Review and update tenant administrator roles and access controls.
• Monitor invite and staff user management for potential abuse or misuse.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is caused by the `StaffService.deleteStaffMember()` method running an additional invite cleanup that deletes from the central `user_invite` table by email without a `tenantId` predicate. This results in pending invites being removed across all tenants that share the deleted staff's email.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.