CVE-2026-48074

{
  "id": "CVE-2026-48074",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-06T22:17:09.833",
  "lastModified": "2026-10-23T21:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANT_ADMIN deletes an existing staff user, the underlying `StaffService.deleteStaffMember()` runs an additional invite cleanup that deletes from the central `user_invite` table by email. The `email` clause has no `tenantId` predicate. Any pending invite in any tenant that shares the deleted staff's email is removed. A TENANT_ADMIN of tenant A who deletes a staff record with email `victim[@]example[.]com` also deletes the pending invite for `victim[@]example[.]com` in tenant B, even though they have no relationship to tenant B. The user-side delete is correctly scoped (`eq(user.id, staffId), eq(user.tenantId, tenantId)`), and the pending-invite-only delete path (when `staffId` is itself an invite ID) is also tenant-scoped. The bug is specifically in the invite cleanup that runs as a side effect of deleting an existing staff user. Version 1.0.6 patches the issue."
    },
    {
      "lang": "es",
      "value": "El software de reserva de citas de OpenReception proporciona una plataforma de reserva de citas cifrada de extremo a extremo. Antes de la versión 1.0.6, cuando un TENANT_ADMIN elimina un usuario de personal existente, el subyacente ’StaffService.deleteStaffMember()’ ejecuta una limpieza adicional de invitaciones que elimina de la tabla central ’user_invite’ por correo electrónico. La cláusula ’email’ no tiene un predicado ’tenantId’. Cualquier invitación pendiente en cualquier inquilino que comparta el correo electrónico del personal eliminado es eliminada. Un TENANT_ADMIN del inquilino A que elimina un registro de personal con el correo electrónico ’victim[@]example[.]com’ también elimina la invitación pendiente para ’victim[@]example[.]com’ en el inquilino B, aunque no tengan ninguna relación con el inquilino B. La eliminación del lado del usuario está correctamente delimitada (’eq(user.id, staffId), eq(user.tenantId, tenantId)’), y la ruta de eliminación solo para invitaciones pendientes (cuando ’staffId’ es en sí mismo un ID de invitación) también está delimitada por inquilino. El error está específicamente en la limpieza de invitaciones que se ejecuta como un efecto secundario de la eliminación de un usuario de personal existente. La versión 1.0.6 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "open-reception",
          "product": "appointment-booking-software",
          "versions": [
            {
              "version": "< 1.0.6",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
          "baseScore": 2.7,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T17:01:50.443635Z",
          "id": "CVE-2026-48074",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/open-reception/appointment-booking-software/commit/5e77fd1df4262d09bfa6b59acfec4f66408de570",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-6f8g-wfxp-mqxw",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-6f8g-wfxp-mqxw",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}