External risk intelligence

OpenReception Privilege Escalation via Tenant Admin Role Update.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-48086

The software is an appointment booking platform that is explicitly described as a hosted service where users interact with the application over the internet. As a web-based service facilitating external tenant access and administration, it is commonly deployed as an internet-facing web application.

Privilege Escalation

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects OpenReception's appointment booking software, allowing a tenant administrator to gain full administrative control over the entire platform, including all other tenants' data and configurations. This privilege escalation could expose sensitive appointment details and operational metadata across the service if not addressed. The main concern is confirming relevance and exposure.

Tenant admin gains full platform control.
Impacts all customer data and configurations.
Confirm relevance and exposure to all tenants.

Attack Path

How an attacker could exploit the issue

An attacker with tenant administrator privileges can escalate their access to a platform-wide administrator. This is achieved by sending a specific request that bypasses authorization checks, effectively granting them control over all tenant data and configurations.

Tenant administrator access required.
Triggered by a PUT request to update roles.
Risk: Full platform administrative control.

Live Threat

Current exploitation, exposure, and threat context

A tenant administrator could gain unrestricted administrative control over the entire platform, affecting all customer data and system configurations. This could occur when a tenant administrator uses a specific request to promote themselves to a global administrator, bypassing necessary policy checks.

Tenant data and platform configuration.
Admin promotes self via PUT request.
Full platform administrative control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The critical privilege escalation vulnerability in OpenReception's appointment booking software necessitates immediate attention from platform administrators and application owners. The first practical step is to identify all instances of the affected software, determine their reachability and business criticality, and confirm the accountable owner for each deployment. Remediation planning should then be prioritized based on the identified risk, with a focus on coordinating with the vendor for updates or implementing compensating controls if immediate patching is not feasible.

Platform or application owners should investigate.
Verify affected deployments and business impact.
Coordinate vendor updates or apply controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenReception appointment booking software?

OpenReception is a platform designed for managing appointment schedules, typically used by businesses to handle client bookings and staff coordination. It supports multi-tenant environments where distinct organizations share the same software infrastructure to manage their own specific users, staff records, and operational configurations.

What does CWE-269 mean in CVE-2026-48086?

CWE-269 is Improper Privilege Management. In this CVE, it means the software fails to verify if a user has the authority to assign themselves elevated permissions. Instead of checking if the person making a change is already a global administrator, the system blindly accepts a request to change a user's role, allowing a low-level tenant administrator to bypass security and grant themselves full control over the entire platform.

How is this privilege escalation triggered?

An attacker triggers this by sending a specifically crafted PUT request to the role-update handler. By including the 'GLOBAL_ADMIN' value in their request, they trick the system into elevating their account. Importantly, this only works if the user already has valid tenant administrator credentials; a standard user or an unauthenticated visitor cannot trigger this update.

Who should be concerned about CVE-2026-48086?

Anyone running OpenReception should care, especially those hosting the platform for multiple customers. According to Halo Surface Signal, because this is a web-based service designed for external tenant access, it is frequently exposed to the internet, making it reachable by any existing tenant administrator who might attempt to abuse their current access level.

What is the first step to address this risk?

Your immediate priority is to update the software to version 1.0.2, which corrects the authorization check. Before patching, identify all active deployments of the software in your environment and verify which accounts currently hold tenant-level administrative privileges, as these are the only accounts capable of exploiting this specific vulnerability.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.