Executive brief
OpenReception is an appointment booking platform that encrypts scheduling data end-to-end. A tenant administrator can exploit a flaw in the role-update API to promote themselves to full platform-wide administrator status with a single request, gaining complete control over all other tenants' configuration, user accounts, staff records, and operational data. An attacker could abuse this to access sensitive appointment information, manipulate business operations, or compromise the entire shared platform.
Technical details
The vulnerability is an authorization bypass in the role-update handler that accepts GLOBAL_ADMIN role assignments from any TENANT_ADMIN user. The root cause is that the API relies solely on schema validation to enforce authorization policy, with no runtime check confirming that only existing GLOBAL_ADMIN users may grant GLOBAL_ADMIN role. An unauthenticated tenant administrator can submit a PUT request to promote their own account or a colleague's account to GLOBAL_ADMIN; upon JWT refresh, the escalated role grants access to every tenant's data and configuration on the platform. This is a critical privilege escalation on multi-tenant hosted instances where a single customer's admin gains platform-wide breach capability, and also affects self-hosted deployments. Version 1.0.2 remediates the issue by enforcing proper authorization checks.
Affected products
- OpenReception Appointment Booking Software prior to 1.0.2
Timeline
- 2026-08-06: disclosed
- 2026-08-06: patched: Version 1.0.2 released