PatchSiren cyber security CVE debrief
CVE-2026-48086 open-reception CVE debrief
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN promotes themselves to platform-wide GLOBAL_ADMIN through a single PUT request. The role-update handler accepts the `GLOBAL_ADMIN` enum value from any tenant admin updating their own tenant's staff. No policy check enforces that only an existing GLOBAL_ADMIN may grant GLOBAL_ADMIN, so the schema validation IS the authorization decision. After re-login, the JWT contains the new role and the formerly-tenant-scoped admin reaches every other tenant on the platform. On the hosted OpenReception service this is a scope-changed escalation: a single customer-side tenant administrator gains full platform-wide administrative control over all other tenants' configuration, users, staff records, operational metadata, and tenant lifecycle. Plaintext appointment contents remain subject to the E2E model unless chained with the staff-crypto poisoning issue (V-4) or with staff-passkey hijacking (V-1). On a single-tenant self-hosted deployment it is still a privilege escalation because TENANT_ADMIN should not be able to create new tenants, modify global configuration, or manage other administrators. The same handler also accepts updates targeted at any colleague within the tenant. A tenant admin can promote a separate collaborator account instead of themselves, leaving their own audit trail clean while the platform-wide breach happens through a separate identity. Version 1.0.2 fixes the issue. Administrators and users of OpenReception's appointment booking software, especially those with tenant administrator roles, should be aware of this critical vulnerability and take immediate action to update to version 1.0.2 or later. Additionally, security teams and IT professionals responsible for managing and securing the platform should prioritize patching and monitoring for potential exploitation.
- Vendor
- open-reception
- Product
- appointment-booking-software
- CVSS
- CRITICAL 9.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-06
- Original CVE updated
- 2026-08-07
- Advisory published
- 2026-08-06
- Advisory updated
- 2026-08-07
Who should care
Administrators and users of OpenReception's appointment booking software, especially those with tenant administrator roles, should be aware of this critical vulnerability and take immediate action to update to version 1.0.2 or later. Additionally, security teams and IT professionals responsible for managing and securing the platform should prioritize patching and monitoring for potential exploitation.
Technical summary
The vulnerability exists in the role-update handler of OpenReception's appointment booking software prior to version 1.0.2. This handler accepts the GLOBAL_ADMIN enum value from any tenant admin updating their own tenant's staff without enforcing that only an existing GLOBAL_ADMIN may grant GLOBAL_ADMIN. This results in a scope-changed escalation on the hosted OpenReception service, giving a single customer-side tenant administrator full platform-wide administrative control over all other tenants' configuration, users, staff records, operational metadata, and tenant lifecycle.
Defensive priority
CVE-2026-48086 is a critical vulnerability with a CVSS score of 9.9. OpenReception's appointment booking software prior to version 1.0.2 allows a tenant admin to promote themselves to platform-wide GLOBAL_ADMIN through a single PUT request, enabling scope-changed escalation on the hosted service and privilege escalation on single-tenant self-hosted deployments.
Recommended defensive actions
- Review and apply the patch to update to version 1.0.2 or later
- Restrict administrative access to sensitive areas of the platform
- Monitor for suspicious activity and implement additional logging and auditing
- Consider implementing compensating controls such as role-based access control and separation of duties
- Inventory and verify the integrity of all tenant configurations and user accounts
Evidence notes
The vulnerability allows a tenant admin to promote themselves to platform-wide GLOBAL_ADMIN through a single PUT request. The role-update handler accepts the GLOBAL_ADMIN enum value from any tenant admin updating their own tenant's staff without enforcing that only an existing GLOBAL_ADMIN may grant GLOBAL_ADMIN. This results in a scope-changed escalation on the hosted OpenReception service, giving a single customer-side tenant administrator full platform-wide administrative control over all other tenants' configuration, users, staff records, operational metadata, and tenant lifecycle.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T22:17:11.593Z and has not been modified since then.