Description
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANT_ADMIN deletes an existing staff user, the underlying `StaffService.deleteStaffMember()` runs an additional invite cleanup that deletes from the central `user_invite` table by email. The `email` clause has no `tenantId` predicate. Any pending invite in any tenant that shares the deleted staff's email is removed. A TENANT_ADMIN of tenant A who deletes a staff record with email `victim[@]example[.]com` also deletes the pending invite for `victim[@]example[.]com` in tenant B, even though they have no relationship to tenant B. The user-side delete is correctly scoped (`eq(user.id, staffId), eq(user.tenantId, tenantId)`), and the pending-invite-only delete path (when `staffId` is itself an invite ID) is also tenant-scoped. The bug is specifically in the invite cleanup that runs as a side effect of deleting an existing staff user. Version 1.0.6 patches the issue.
Published: 2026-08-06
Score: 2.7 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

OpenReception's appointment booking platform allows tenant administrators to delete staff members. When a staff member is removed, the system runs an invite cleanup routine that deletes any pending invites matching the staff member's email address, but the database query does not include a tenant identifier. As a result, invites belonging to users in other tenants that share the same email address are also removed, causing unintended data loss and disrupting booking workflows. The flaw is a missing authorization check – a classic instance of CWE-863.

Affected Systems

The vulnerability is present in open-reception:appointment-booking-software prior to version 1.0.6. Any deployment running 1.0.5 or earlier is affected; upgrading to 1.0.6 or later eliminates the issue.

Risk and Exploitability

The CVSS score is 2.7, indicating low severity. EPSS information is unavailable and the vulnerability is not listed in CISA KEV. Attackers would need tenant‑administrator privileges to trigger the deletion, so the exploit surface is confined to authorized admins. Nevertheless, the cross‑tenant removal of pending invites can lead to data loss for other tenants, warranting prompt remediation.

Generated by OpenCVE AI on August 7, 2026 at 00:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor patch to version 1.0.6 or later.
  • If an immediate upgrade is not possible, avoid deleting staff members whose email address may belong to users in other tenants, or pre‑validate pending invites before deletion.
  • Monitor deletion logs for unexpected invite removals and restore any unintentionally deleted invites from backups as a fallback.

Generated by OpenCVE AI on August 7, 2026 at 00:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 06 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANT_ADMIN deletes an existing staff user, the underlying `StaffService.deleteStaffMember()` runs an additional invite cleanup that deletes from the central `user_invite` table by email. The `email` clause has no `tenantId` predicate. Any pending invite in any tenant that shares the deleted staff's email is removed. A TENANT_ADMIN of tenant A who deletes a staff record with email `victim[@]example[.]com` also deletes the pending invite for `victim[@]example[.]com` in tenant B, even though they have no relationship to tenant B. The user-side delete is correctly scoped (`eq(user.id, staffId), eq(user.tenantId, tenantId)`), and the pending-invite-only delete path (when `staffId` is itself an invite ID) is also tenant-scoped. The bug is specifically in the invite cleanup that runs as a side effect of deleting an existing staff user. Version 1.0.6 patches the issue.
Title OpenReception: Staff deletion removes pending invites cross-tenant by email match
Weaknesses CWE-863
References
Metrics cvssV3_1

{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-06T20:27:21.240Z

Reserved: 2026-05-20T18:25:25.708Z

Link: CVE-2026-48074

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-07T00:30:06Z

Weaknesses