EUVD-2026-54258Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
S:C selected over NVD's S:U because integrity impact crosses tenant security authority boundaries; PR:H confirmed by TENANT_ADMIN requirement; no confidentiality or availability impact applies.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANT_ADMIN deletes an existing staff user, the underlying StaffService.deleteStaffMember() runs an additional invite cleanup that deletes from the central user_invite table by email. The email clause has no tenantId predicate. Any pending invite in any tenant that shares the deleted staff's email is removed. A TENANT_ADMIN of tenant A who deletes a staff record with email victim[@]example[.]com also deletes the pending invite for victim[@]example[.]com in tenant B, even though they have no relationship to tenant B. The user-side delete is correctly scoped (eq(user.id, staffId), eq(user.tenantId, tenantId)), and the pending-invite-only delete path (when staffId is itself an invite ID) is also tenant-scoped. The bug is specifically in the invite cleanup that runs as a side effect of deleting an existing staff user. Version 1.0.6 patches the issue.
AnalysisAI
Cross-tenant invite deletion in OpenReception's appointment booking software (prior to 1.0.6) allows an authenticated TENANT_ADMIN to destroy pending onboarding invites belonging to unrelated tenants on the same platform instance. The flaw exists because the invite cleanup query inside StaffService.deleteStaffMember() matches only on email address without constraining to the acting tenant's ID, causing any staff deletion to silently cascade-delete matching invites across all tenants. No active exploitation has been identified and no public exploit code exists; the issue is fully remediated in version 1.0.6 via a single ORM predicate addition.
Technical ContextAI
The vulnerability is in src/lib/server/services/staff-service.ts within the StaffService.deleteStaffMember() method of OpenReception's TypeScript/Node.js backend. The application uses a query-builder ORM (evidenced by eq(), or(), and and() helper functions visible in the commit diff). The user_invite table stores pending invitations for all tenants in a shared schema. The secondary cleanup query - intended to remove orphaned invites when a staff member is deleted - used OR(createdUserId = staffId, email = userToDelete.email) without an enclosing AND(tenantId = tenantId) constraint. In a multi-tenant SaaS architecture, this permits unscoped DELETE operations across the entire shared table. CWE-863 (Incorrect Authorization) precisely describes the root cause: the system executes a privileged data-mutation action that exceeds the requesting principal's authorization scope. The fix in commit 5e77fd1df4262d09bfa6b59acfec4f66408de570 wraps the OR clause inside AND(eq(userInvite.tenantId, tenantId), OR(...)), correctly bounding the cleanup to the acting tenant.
RemediationAI
Upgrade OpenReception appointment-booking-software to version 1.0.6 or later, which is confirmed as the patched release per EUVD-2026-54258 and GitHub Security Advisory GHSA-6f8g-wfxp-mqxw (https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-6f8g-wfxp-mqxw). The underlying fix is applied in commit 5e77fd1df4262d09bfa6b59acfec4f66408de570. If an immediate upgrade is not feasible, a compensating control would be to revoke or restrict TENANT_ADMIN accounts' ability to perform staff deletions at the application layer or via network access control to the relevant API endpoint - this trades off routine administrative capability and does not fully eliminate risk if the endpoint cannot be blocked selectively. No other workaround eliminates the cross-tenant data leakage path short of patching.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today