A critical privilege escalation vulnerability in OpenReception appointment booking software allows a tenant administrator to gain full global administrative control over the entire platform.

This is an improper privilege management vulnerability (CWE-269) where the application fails to enforce policy checks during role updates. An authenticated tenant administrator can use a PUT request to grant themselves or others global administrative privileges without proper authorization.

An attacker who successfully exploits this vulnerability gains full control over all tenant configurations, user records, and operational metadata across the entire instance. With a CVSS score of 9.9, this represents a catastrophic risk to platform integrity and cross-tenant data isolation.

Immediate Action: Update OpenReception appointment-booking-software to version 1.0.2 or later to implement strict server-side authorization checks for administrative role changes.

Proactive Monitoring: Audit user roles and administrative logs for any unauthorized elevation of privileges or unexpected changes to the global administrator group.

Compensating Controls: Restrict access to administrative management endpoints via network access control lists (ACLs) to ensure only known, trusted administrative IP addresses can perform role modifications.

Public Exploit Available: Unknown

Given the potential for total platform takeover, immediate remediation is required. Organizations must update to version 1.0.2 to prevent unauthorized escalation of administrative privileges.