CVE-2026-48086: OpenReception privilege escalation in role-update handler

CVE-2026-48086 · Severity: critical · CVSS 9.9 · Published 2026-08-06

OpenReception is an appointment booking platform that encrypts scheduling data end-to-end. A tenant administrator can exploit a flaw in the role-update API to promote themselves to full platform-wide administrator status with a single request, gaining complete control over all other tenants' configuration, user accounts, staff records, and operational data. An attacker could abuse this to access sensitive appointment information, manipulate business operations, or compromise the entire shared platform.

Technologies: OpenReception Appointment-Booking-Software. Vendors: OpenReception.

Quick answers

Is CVE-2026-48086 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48086 being exploited in the wild.
How severe is CVE-2026-48086?
Critical severity, with a CVSS score of 9.9, published 6 August 2026.
Which products and versions are affected?
OpenReception Appointment-Booking-Software prior to 1.0.2.
Is there a fix for CVE-2026-48086?
A patch was published on 2026-08-06: Version 1.0.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48086 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-48086?
Check whether you run OpenReception Appointment-Booking-Software at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in the role-update handler that accepts GLOBAL_ADMIN role assignments from any TENANT_ADMIN user. The root cause is that the API relies solely on schema validation to enforce authorization policy, with no runtime check confirming that only existing GLOBAL_ADMIN users may grant GLOBAL_ADMIN role. An unauthenticated tenant administrator can submit a PUT request to promote their own account or a colleague's account to GLOBAL_ADMIN; upon JWT refresh, the escalated role grants access to every tenant's data and configuration on the platform. This is a critical privilege escalation on multi-tenant hosted instances where a single customer's admin gains platform-wide breach capability, and also affects self-hosted deployments. Version 1.0.2 remediates the issue by enforcing proper authorization checks.

Affected products

  • OpenReception Appointment Booking Software prior to 1.0.2

Timeline

  • 2026-08-06: disclosed
  • 2026-08-06: patched: Version 1.0.2 released

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.