CVE-2026-48086
OpenReception: Tenant admin self-promotes to GLOBAL_ADMIN
Description
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN promotes themselves to platform-wide GLOBAL_ADMIN through a single PUT request. The role-update handler accepts the `GLOBAL_ADMIN` enum value from any tenant admin updating their own tenant's staff. No policy check enforces that "only an existing GLOBAL_ADMIN may grant GLOBAL_ADMIN", so the schema validation IS the authorization decision. After re-login, the JWT contains the new role and the formerly-tenant-scoped admin reaches every other tenant on the platform. On the hosted OpenReception service this is a scope-changed escalation: a single customer-side tenant administrator gains full platform-wide administrative control over all other tenants' configuration, users, staff records, operational metadata, and tenant lifecycle. Plaintext appointment contents remain subject to the E2E model unless chained with the staff-crypto poisoning issue (V-4) or with staff-passkey hijacking (V-1). On a single-tenant self-hosted deployment it is still a privilege escalation because TENANT_ADMIN should not be able to create new tenants, modify global configuration, or manage other administrators. The same handler also accepts updates targeted at any colleague within the tenant. A tenant admin can promote a separate collaborator account instead of themselves, leaving their own audit trail clean while the platform-wide breach happens through a separate identity. Version 1.0.2 fixes the issue.
INFO
Published Date :
Aug. 6, 2026, 10:17 p.m.
Last Modified :
Oct. 23, 2026, 9:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-48086
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | CRITICAL | [email protected] | ||||
| CVSS 3.1 | CRITICAL | MITRE-CVE |
Solution
- Update OpenReception to version 1.0.2.
- Apply vendor patches for role management.
- Review access control policies.
- Verify administrative privileges.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-48086.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-48086 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-48086
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-48086 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-48086 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Added Translation Title: appointment-booking-software de open-reception, Description: El software de reserva de citas de OpenReception proporciona una plataforma de reserva de citas cifrada de extremo a extremo. Antes de la versión 1.0.2, un TENANT_ADMIN se asciende a sí mismo a GLOBAL_ADMIN de toda la plataforma a través de una única solicitud PUT. El gestor de actualización de roles acepta el valor de enumeración ’GLOBAL_ADMIN’ de cualquier administrador de inquilino que actualice el personal de su propio inquilino. Ninguna comprobación de política impone que ’solo un GLOBAL_ADMIN existente puede otorgar GLOBAL_ADMIN’, por lo que la validación del esquema ES la decisión de autorización. Después de volver a iniciar sesión, el JWT contiene el nuevo rol y el administrador con alcance de inquilino anterior accede a todos los demás inquilinos de la plataforma. En el servicio alojado de OpenReception, esto es una escalada con cambio de alcance: un único administrador de inquilino del lado del cliente obtiene control administrativo completo de toda la plataforma sobre la configuración, usuarios, registros de personal, metadatos operativos y ciclo de vida de todos los demás inquilinos. Los contenidos de las citas en texto plano permanecen sujetos al modelo E2E a menos que se encadenen con el problema de envenenamiento de criptografía del personal (V-4) o con el secuestro de clave de acceso del personal (V-1). En una implementación autoalojada de un solo inquilino, sigue siendo una escalada de privilegios porque TENANT_ADMIN no debería poder crear nuevos inquilinos, modificar la configuración global o gestionar otros administradores. El mismo gestor también acepta actualizaciones dirigidas a cualquier colega dentro del inquilino. Un administrador de inquilino puede ascender una cuenta de colaborador separada en lugar de a sí mismo, dejando su propio rastro de auditoría limpio mientras que la brecha de toda la plataforma ocurre a través de una identidad separada. La versión 1.0.2 soluciona el problema. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 07, 2026
Action Type Old Value New Value Added Reference https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-5qfr-7q4g-3469 Added SSVC {'id': 'CVE-2026-48086', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-08-07T14:36:33.558143Z'} -
New CVE Received by [email protected]
Aug. 06, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'open-reception', 'product': 'appointment-booking-software', 'versions': [{'status': 'affected', 'version': '< 1.0.2'}]}] Added Description OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN promotes themselves to platform-wide GLOBAL_ADMIN through a single PUT request. The role-update handler accepts the `GLOBAL_ADMIN` enum value from any tenant admin updating their own tenant's staff. No policy check enforces that "only an existing GLOBAL_ADMIN may grant GLOBAL_ADMIN", so the schema validation IS the authorization decision. After re-login, the JWT contains the new role and the formerly-tenant-scoped admin reaches every other tenant on the platform. On the hosted OpenReception service this is a scope-changed escalation: a single customer-side tenant administrator gains full platform-wide administrative control over all other tenants' configuration, users, staff records, operational metadata, and tenant lifecycle. Plaintext appointment contents remain subject to the E2E model unless chained with the staff-crypto poisoning issue (V-4) or with staff-passkey hijacking (V-1). On a single-tenant self-hosted deployment it is still a privilege escalation because TENANT_ADMIN should not be able to create new tenants, modify global configuration, or manage other administrators. The same handler also accepts updates targeted at any colleague within the tenant. A tenant admin can promote a separate collaborator account instead of themselves, leaving their own audit trail clean while the platform-wide breach happens through a separate identity. Version 1.0.2 fixes the issue. Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Added CWE CWE-269 Added Reference https://github.com/open-reception/appointment-booking-software/commit/8525d35a41c31078d9f01c62e9687e653cf1a494 Added Reference https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-5qfr-7q4g-3469