CVE-2026-48085

Received Received - Intake

Unauthenticated Admin Account Creation in OpenReception

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to `/setup/create-admin-account` and creates additional GLOBAL_ADMIN accounts without verifying that an admin already exists. Any unauthenticated network attacker who can submit a same-origin form POST gains full platform-level administrative control. The newly created account is `is_active=true` with `confirmation_state=ACCESS_GRANTED` and does not require completing email confirmation; the GLOBAL_ADMIN row is created active and immediately usable. Login and tenant enumeration succeed without any further interaction. This is distinct from the deployment race condition already documented on the `Claiming an instance` page. That documented race covers the window between deployment and first claim. The bug reported here works after the operator has properly claimed and configured the instance: the layout-level guard that protects the setup page only redirects on GET, while the `default` form action handler creates the user without rechecking `adminExists()`. Three GLOBAL_ADMIN accounts were created in succession during testing, with no rate limiting observed. Audit-specific event logging beyond standard application logs was not assessed; the standard `[error]` line that surfaces only when a uniqueness conflict is hit is not the same as a security event for "additional admin created post-claim". The form post is rejected for browser drive-by CSRF by SvelteKit's built-in same-origin check, but any tool that supplies a matching `Origin` header (curl, Burp, automated scanners, server-side proxies) bypasses this trivially. No additional preconditions exist. Users should upgrade to version 1.0.1 to receive a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-48085

Affected Vendors & Products

Vendor	Product	Version / Range
openreception	appointment_booking_software	1.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability allows unauthenticated attackers to create additional global admin accounts in OpenReception's appointment booking software before version 1.0.1. The flaw exists because the system accepts POST requests to /setup/create-admin-account without verifying if an admin already exists. Attackers can exploit this by submitting a form POST request, gaining full administrative control of the platform.

Detection Guidance

To detect this vulnerability, check for unauthenticated POST requests to /setup/create-admin-account. Use network monitoring tools like curl to send a test POST request with an Origin header. Example: curl -X POST -H "Origin: http://yourdomain.com" http://target/system/setup/create-admin-account. If the server responds by creating a new admin account without authentication, the system is vulnerable.

Impact Analysis

An attacker could gain full administrative access to your OpenReception instance, allowing them to manage appointments, access sensitive data, and perform unauthorized actions. Since no email confirmation is required, the attack can be executed remotely without user interaction.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Unauthorized admin access may result in data breaches, non-compliance with access controls, and failure to meet audit logging standards.

Mitigation Strategies

Immediately upgrade to OpenReception version 1.0.1 or later to patch the vulnerability. Ensure no unauthorized admin accounts exist by reviewing user roles and permissions. Monitor logs for suspicious POST requests to /setup/create-admin-account.

Hi! I’m here to help you understand CVE-2026-48085. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70