CVE-2026-48080: OpenReception appointment booking software database credential disclosure

CVE-2026-48080 · Severity: high · CVSS 8 · Published 2026-08-06

OpenReception is an encrypted appointment booking platform used to securely store sensitive appointment data and user information. Prior to version 1.0.2, a flaw allows any tenant administrator to view the live database connection credentials, including plaintext passwords, through an API endpoint. An attacker with these credentials can bypass the application's security controls and access all appointment data, user records, and sensitive information across all tenants hosted on the same database server, potentially compromising data for hundreds of customers and enabling further system compromise.

Technologies: OpenReception Appointment-Booking-Software. Vendors: OpenReception.

Quick answers

Is CVE-2026-48080 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48080 being exploited in the wild.
How severe is CVE-2026-48080?
High severity, with a CVSS score of 8, published 6 August 2026.
Which products and versions are affected?
OpenReception Appointment-Booking-Software prior to 1.0.2.
Is there a fix for CVE-2026-48080?
A patch was published on 2026: Fixed in version 1.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48080 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-48080?
Check whether you run OpenReception Appointment-Booking-Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a credential disclosure flaw in the GET /api/tenants/{id} endpoint. The endpoint returns the full tenant record to any authenticated TENANT_ADMIN, including the databaseUrl field which contains the plaintext PostgreSQL connection string with username and password. In standard deployments, this credential is configured as a superuser (postgres with rolsuper=true), allowing an attacker who obtains it to connect directly to the PostgreSQL database server on port 5432, completely bypassing the application's per-tenant isolation. From the database level, the attacker can read all tenant databases, the central user table with global admin credentials, and in superuser deployments can use PostgreSQL's file read, command execution, and extension loading capabilities for further privilege escalation. No authentication to the application is required beyond having TENANT_ADMIN role for any single tenant. The fix in version 1.0.2 resolves this issue.

Affected products

  • OpenReception appointment booking software prior to 1.0.2

Timeline

  • 2026-08-06: disclosed
  • 2026: patched: Fixed in version 1.0.2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.