Quick answers
- Is CVE-2026-48074 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48074 being exploited in the wild.
- How severe is CVE-2026-48074?
- Low severity, with a CVSS score of 2.7, published 6 August 2026.
- Which products and versions are affected?
- OpenReception Appointment-Booking-Software <1.0.6.
- Is there a fix for CVE-2026-48074?
- A patch was published on 2026: Version 1.0.6 includes fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-48074 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-48074?
- Check whether you run OpenReception Appointment-Booking-Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a missing tenant isolation (CWE-1308) in the StaffService.deleteStaffMember() function. When a TENANT_ADMIN deletes a staff member, the code runs an invite cleanup query that deletes rows from the user_invite table by email address: `or(eq(userInvite.createdUserId, staffId), eq(userInvite.email, userToDelete.email))`. The email clause lacks a tenantId predicate, allowing deletion of any pending invite across all tenants with a matching email. The user-side delete is correctly scoped to the tenant, making this a side-effect bug. Attack requires TENANT_ADMIN role (low privilege) and network access to the platform API. An attacker can invoke this by deleting any staff member in their controlled tenant whose email matches pending invites in target tenants. The issue is patched in version 1.0.6.
Affected products
- OpenReception appointment-booking-software <1.0.6
Timeline
- 2026-08-06: disclosed
- 2026: patched: Version 1.0.6 includes fix