CVE-2026-48086

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.2

Description A privilege escalation exists where a user with TENANT ADMIN permissions can promote themselves or another collaborator to a platform-wide GLOBAL ADMIN via a single PUT request. The role-update handler fails to enforce a policy check ensuring that only existing global administrators can grant the GLOBAL ADMIN role, relying instead on schema validation for authorization. Upon re-login, the JSON Web Token (JWT)—a compact, URL-safe means of representing claims to parties—is updated with the new role. This allows a tenant-scoped administrator to gain full administrative control over all other tenants' configurations, users, staff records, operational metadata, and tenant lifecycles on hosted services. In self-hosted single-tenant deployments, this allows unauthorized creation of tenants, modification of global configurations, and management of other administrators.

Recommendations Update to version 1.0.2.