PT-2026-68742

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.2 Description The GET /api/tenants/id endpoint returns the full tenant record to any authenticated TENANT ADMIN, exposing the databaseUrl field. This field contains the live PostgreSQL connection string used...

CVE-2026-48080: Exposure of Sensitive Information to an Unauthorized Actor

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the GET /api/tenants/id endpoint returns the full tenant record to any authenticated TENANTADMIN of that tenant, including the databaseUrl field. This field contains...