CVE-2026-48074: CWE-863: Incorrect Authorization in open-reception appointment-booking-software
OpenReception's appointment booking software prior to version 1.0.6 contains an authorization flaw where a TENANT_ADMIN deleting a staff user inadvertently removes pending invites associated with that user's email across all tenants, not just their own. This occurs because the invite cleanup query lacks tenant scoping. The issue is fixed in version 1.0.6.
AI Analysis
Technical Summary
CVE-2026-48074 describes an incorrect authorization vulnerability (CWE-863) in OpenReception's appointment booking software. When a TENANT_ADMIN deletes a staff user, the system runs an invite cleanup that deletes pending invites by matching email addresses without restricting the operation to the tenant context. Consequently, a TENANT_ADMIN from one tenant can delete pending invites belonging to another tenant if they share the same email address. The user deletion itself is properly tenant-scoped, and the invite-only deletion path is also tenant-scoped, but the side-effect invite cleanup during staff deletion is not. This bug is resolved in version 1.0.6.
Potential Impact
The vulnerability allows a TENANT_ADMIN to remove pending invites for users in other tenants if those users share the same email address. This could disrupt user onboarding or invite processes across tenants but does not expose or modify user data beyond invite deletion. The CVSS score of 2.7 reflects a low severity impact with limited integrity impact and no confidentiality or availability impact.
Mitigation Recommendations
Upgrade to OpenReception appointment booking software version 1.0.6 or later, where this issue is patched. No other mitigation is indicated or required.
CVE-2026-48074: CWE-863: Incorrect Authorization in open-reception appointment-booking-software
Description
OpenReception's appointment booking software prior to version 1.0.6 contains an authorization flaw where a TENANT_ADMIN deleting a staff user inadvertently removes pending invites associated with that user's email across all tenants, not just their own. This occurs because the invite cleanup query lacks tenant scoping. The issue is fixed in version 1.0.6.
CVSS v3.1
Score 2.7low
Affected software
pkg:github/open-reception/appointment-booking-softwareRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-48074 describes an incorrect authorization vulnerability (CWE-863) in OpenReception's appointment booking software. When a TENANT_ADMIN deletes a staff user, the system runs an invite cleanup that deletes pending invites by matching email addresses without restricting the operation to the tenant context. Consequently, a TENANT_ADMIN from one tenant can delete pending invites belonging to another tenant if they share the same email address. The user deletion itself is properly tenant-scoped, and the invite-only deletion path is also tenant-scoped, but the side-effect invite cleanup during staff deletion is not. This bug is resolved in version 1.0.6.
Potential Impact
The vulnerability allows a TENANT_ADMIN to remove pending invites for users in other tenants if those users share the same email address. This could disrupt user onboarding or invite processes across tenants but does not expose or modify user data beyond invite deletion. The CVSS score of 2.7 reflects a low severity impact with limited integrity impact and no confidentiality or availability impact.
Mitigation Recommendations
Upgrade to OpenReception appointment booking software version 1.0.6 or later, where this issue is patched. No other mitigation is indicated or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-20T18:25:25.708Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a750704bf8831d5395f5a50
Added to database: 08/06/2026, 22:13:24 UTC
Last enriched: 08/06/2026, 23:12:32 UTC
Last updated: 08/06/2026, 23:41:16 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.