OpenReception’s appointment booking software, prior to version 1.0.2, inadvertently exposed a full PostgreSQL connection string via the tenant detail endpoint. The published URL contains a superuser (postgres) credential and a plaintext password, allowing an authenticated tenant administrator to connect directly to the PostgreSQL instance. This enables the attacker to read all tenant databases, central user tables, and administrative data, as well as to modify or delete data across all tenants. The breach not only compromises confidentiality but also integrity, as the exposed credentials let an attacker fully compromise tenant isolation and may be leveraged for further database‑level escalation if the deployment runs with superuser-scoped PostgreSQL users.

The affected product is OpenReception’s appointment booking software, version older than 1.0.2. All vendors using the official docker‑compose.prod.yml deployment that includes a PostgreSQL superuser run directly through the application’s data layer are susceptible. The vulnerability is present in the GET /api/tenants/{id} endpoint for any authenticated TENANT_ADMIN of any tenant.

The CVSS score of 8 reflects a high severity for potential exploitation. While the EPSS score is not available, the vulnerability is not listed in CISA KEV, suggesting it has not yet been widely exploited. The likely attack vector requires an authenticated TENANT_ADMIN who can reach the internal PostgreSQL port, which may be achieved through normal application access or via indirect SSRF, RCE, or file‑read primitives that expose the container network. Once the attacker obtains the superuser credentials, they can bypass the application’s tenant isolation and gain full control over all tenant data and administrative settings.