CVE-2026-48086 describes a critical improper privilege management vulnerability (CWE-269) in OpenReception's appointment booking software. Before version 1.0.2, a tenant administrator can promote themselves or another tenant staff member to the GLOBAL_ADMIN role through a single PUT request without proper authorization checks. The role-update handler accepts the GLOBAL_ADMIN enum value from any tenant admin updating their tenant's staff, relying solely on schema validation rather than enforcing that only existing GLOBAL_ADMINs can grant this role. This results in a scope-chained privilege escalation where a tenant admin gains full platform-wide administrative control over all tenants' configurations, users, and operational data. On self-hosted single-tenant deployments, this still allows unauthorized creation of tenants and global configuration changes. The vulnerability is resolved in version 1.0.2.

An attacker with tenant administrator privileges can escalate to global administrator, gaining full control over all tenants on the platform, including configuration, user management, and tenant lifecycle operations. This compromises the confidentiality, integrity, and availability of the entire multi-tenant platform. Although appointment contents remain protected by end-to-end encryption unless combined with other vulnerabilities, the administrative breach allows extensive unauthorized access and control.

Upgrade to OpenReception appointment booking software version 1.0.2 or later, where this privilege escalation vulnerability is fixed. No other mitigation is required as the fix enforces proper authorization checks for role updates. Patch status is not explicitly stated beyond the fix in 1.0.2, so verify with vendor advisory for confirmation.