The vulnerability in OpenReception's appointment booking software (CVE-2026-48080) involves exposure of sensitive information (CWE-200) through the GET /api/tenants/{id} API endpoint. Authenticated TENANT_ADMIN users can retrieve the full tenant record, including the PostgreSQL connection string containing superuser credentials. This allows an attacker with TENANT_ADMIN privileges and network access to the database server to bypass application-level tenant isolation, read or modify data across all tenant databases and the central appointment_booking database, and potentially escalate privileges further using PostgreSQL features. The flaw exists in versions before 1.0.2, which fixes the issue.

An attacker with TENANT_ADMIN privileges on one tenant can obtain superuser database credentials, enabling them to read, modify, or delete data across all tenants and the central administrative database. This compromises confidentiality, integrity, and availability of all tenant data and administrative accounts. The breach of tenant isolation can lead to exposure of sensitive appointment data, user credentials, and session information, as well as potential further escalation within the database environment.

Version 1.0.2 of OpenReception appointment-booking-software fixes this vulnerability by preventing exposure of the database connection string to TENANT_ADMIN users. Operators should upgrade to version 1.0.2 or later. If upgrading is not immediately possible, restrict TENANT_ADMIN access and network access to the PostgreSQL server to trusted users and networks only. Review and rotate database credentials if they may have been exposed.