Executive brief
OpenReception is an encrypted appointment booking platform used to securely store sensitive appointment data and user information. Prior to version 1.0.2, a flaw allows any tenant administrator to view the live database connection credentials, including plaintext passwords, through an API endpoint. An attacker with these credentials can bypass the application's security controls and access all appointment data, user records, and sensitive information across all tenants hosted on the same database server, potentially compromising data for hundreds of customers and enabling further system compromise.
Technical details
The vulnerability is a credential disclosure flaw in the GET /api/tenants/{id} endpoint. The endpoint returns the full tenant record to any authenticated TENANT_ADMIN, including the databaseUrl field which contains the plaintext PostgreSQL connection string with username and password. In standard deployments, this credential is configured as a superuser (postgres with rolsuper=true), allowing an attacker who obtains it to connect directly to the PostgreSQL database server on port 5432, completely bypassing the application's per-tenant isolation. From the database level, the attacker can read all tenant databases, the central user table with global admin credentials, and in superuser deployments can use PostgreSQL's file read, command execution, and extension loading capabilities for further privilege escalation. No authentication to the application is required beyond having TENANT_ADMIN role for any single tenant. The fix in version 1.0.2 resolves this issue.
Affected products
- OpenReception appointment booking software prior to 1.0.2
Timeline
- 2026-08-06: disclosed
- 2026: patched: Fixed in version 1.0.2