Database Exposure Vulnerability in OpenReception's Appointment Booking Software

CVE-2026-48080

What is CVE-2026-48080?

The appointment booking software by OpenReception has a significant vulnerability in its API endpoint that exposes sensitive information. Prior to version 1.0.2, the GET /api/tenants/{id} endpoint reveals the complete tenant record, including the databaseUrl. This URL contains the PostgreSQL connection details used to access the tenant's database, risking exposure of critical information, such as plaintext credentials. Attackers with administrative access can exploit this vulnerability to access, modify, or delete data across multiple tenant databases, compromising the application's security model and tenant isolation. The vulnerability orbits around the ability of a TENANT_ADMIN to interact with the database, potentially leading to severe data breaches and unauthorized data manipulation. Version 1.0.2 addresses this flaw.

References