CVE-2026-48074

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.6

Description An issue exists in the appointment booking platform where a TENANT ADMIN can inadvertently delete pending invites belonging to other tenants. When deleting a staff user, the StaffService.deleteStaffMember() function performs an invite cleanup in the user invite table using only the email variable without a tenantId predicate. This allows an administrator in one tenant to remove pending invites for any user sharing the same email address across different tenants.

Recommendations Update to version 1.0.6.