CVE-2026-48080

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.2

Description The GET /api/tenants/{id} endpoint returns the full tenant record to any authenticated TENANT ADMIN, exposing the databaseUrl field. This field contains the live PostgreSQL connection string used by the application. In default deployments, this string may include superuser credentials. An attacker with these credentials who can reach the database server can bypass application-level isolation to read, modify, or delete data across all tenant databases and the central user table. In superuser-scoped deployments, this can lead to further escalation within the database container using functions such as pg read server files(), COPY ... FROM PROGRAM, and CREATE EXTENSION.

Recommendations Update to version 1.0.2. Restrict access to the GET /api/tenants/{id} endpoint to prevent unauthorized access to the databaseUrl variable.