Loading story…
A critical privilege-escalation flaw tracked as CVE-2026-48086 affected OpenReception appointment-booking software before version 1.0.2, allowing a TENANT_ADMIN to promote themselves or another user in the same tenant to GLOBAL_ADMIN. The issue stemmed from the role-update handler accepting the GLOBAL_ADMIN enum in a single PUT request without enforcing a policy check, and after re-authentication the returned JWT reflected the elevated role. The vulnerability was rated CVSS 9.9 and classified as CWE-269 Improper Privilege Management.
Successful exploitation could grant cross-tenant administrative access in hosted deployments and broader unauthorized administrative control in self-hosted single-tenant environments. OpenReception addressed the issue in version 1.0.2, and the corresponding GitHub patch in src/routes/api/tenants/[id]/staff/[staffId]/+server.ts added an explicit authorization check that blocks assignment of the GLOBAL_ADMIN role by throwing an AuthorizationError during staff update operations.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE record for a critical OpenReception vulnerability was published, describing how a TENANT_ADMIN could promote themselves or a colleague to GLOBAL_ADMIN via a single PUT request in versions before 1.0.2. The advisory states the issue is remotely exploitable, affects hosted and self-hosted deployments, and was fixed in version 1.0.2.
A code change in OpenReception added an explicit authorization check in the tenant staff update endpoint to block assignment of the GLOBAL_ADMIN role, preventing privilege escalation through that route. The fix is associated with GitHub commit 8525d35 and corresponds to the remediation later described as version 1.0.2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenReplay fixed a critical stored cross-site scripting flaw, tracked as **`CVE-2026-55879`**, that affects versions **`1.24.0` before `1.25.0`** and can let an unauthenticated attacker take over dashboard accounts. The issue allows anyone with a public project key to submit malicious custom event names or page URLs that are stored by the platform and later rendered in the authenticated dashboard, where attacker-controlled JavaScript can execute in the dashboard origin, steal the session JWT from `localStorage`, and hijack user access. The vulnerability is rated **CVSS 9.3** and mapped to **`CWE-79`**. The remediation shipped in **OpenReplay `v1.25.0`** and was reflected in subsequent code changes that centralized output encoding for event read paths. The patch escapes event entries and nested property maps on the backend before returning data from `SearchEvents` and `GetEventByID`, and also hardens the frontend by escaping JSON shown in `EventDetailsModal`, replacing `innerHTML` with `textContent` in a text measurement helper, and adding a reusable HTML-escaping utility. Together, the changes indicate the flaw stemmed from unsanitized event content being inserted into the UI without proper output encoding.
Jul 11, 2026
A high-severity access control flaw tracked as **`CVE-2026-63101`** allows unauthenticated attackers to export complete group member rosters from **Open Event Server** through version **1.19.1**. The vulnerability affects the group followers CSV export workflow and can expose sensitive membership data including email addresses, names, join dates, and user roles. Attackers can brute-force sequential group IDs, submit requests to an unauthenticated CSV export `POST` endpoint, poll an unauthenticated task-status endpoint, and retrieve a download URL for the generated file. The issue is remotely exploitable and has been rated **CVSS 3.1 7.5** and **CVSS 4.0 8.7**. Recommended remediation is to upgrade to **Open Event Server 1.19.2 or later** and enforce authentication checks on the affected endpoints.
Jul 18, 2026
Red Hat disclosed **`CVE-2026-73269`**, a critical privilege-escalation flaw in the `cluster-curator-controller` component used by **OpenShift Multicluster Engine for Kubernetes**. The bug allows a tenant with only namespace-level access to create a crafted `ClusterCurator` resource whose `metadata.name` differs from `metadata.namespace`, triggering the controller to create a cluster-scoped `ClusterRoleBinding` and, in some cases, a `RoleBinding` in an arbitrary namespace. Those bindings can attach the tenant’s namespace-local `cluster-installer` service account to the powerful curator role, effectively breaking namespace isolation. Successful exploitation can elevate a local tenant to **cluster-wide privileges**, including access to and manipulation of secrets, management of cluster actions, and deletion of hosted clusters or node pools. The issue carries a **CVSS 3.1 score of 9.9** and affects `multicluster-engine/cluster-curator-controller-rhel9`. Red Hat advised organizations to apply vendor fixes and reduce exposure by restricting creation of `ClusterCurator` resources through RBAC, enforcing matching `metadata.name` and `metadata.namespace` with an admission controller, and reviewing permissions that allow creation of cluster-scoped resources.
Aug 13, 2026