CVE-2026-48086: OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to ver

OpenReception's appointment booking software had a critical flaw before version 1.0.2 where a TENANT_ADMIN (an administrator for one customer's account) could promote themselves to GLOBAL_ADMIN (full platform-wide control) through a single web request, because the system checked the format of the request but not whether the user was actually allowed to make that change. This allowed them to access and control all other customers' data on the platform, or in self-hosted versions, to create new accounts and modify system-wide settings they shouldn't access.