CVE-2026-48085 in Appointment Booking Software
Summary
by MITRE • 08/07/2026
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to `/setup/create-admin-account` and creates additional GLOBAL_ADMIN accounts without verifying that an admin already exists. Any unauthenticated network attacker who can submit a same-origin form POST gains full platform-level administrative control. The newly created account is `is_active=true` with `confirmation_state=ACCESS_GRANTED` and does not require completing email confirmation; the GLOBAL_ADMIN row is created active and immediately usable. Login and tenant enumeration succeed without any further interaction. This is distinct from the deployment race condition already documented on the `Claiming an instance` page. That documented race covers the window between deployment and first claim. The bug reported here works after the operator has properly claimed and configured the instance: the layout-level guard that protects the setup page only redirects on GET, while the `default` form action handler creates the user without rechecking `adminExists()`. Three GLOBAL_ADMIN accounts were created in succession during testing, with no rate limiting observed. Audit-specific event logging beyond standard application logs was not assessed; the standard `[error]` line that surfaces only when a uniqueness conflict is hit is not the same as a security event for "additional admin created post-claim". The form post is rejected for browser drive-by CSRF by SvelteKit's built-in same-origin check, but any tool that supplies a matching `Origin` header (curl, Burp, automated scanners, server-side proxies) bypasses this trivially. No additional preconditions exist. Users should upgrade to version 1.0.1 to receive a patch.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability in OpenReception's appointment booking software represents a critical access control flaw that allows unauthenticated attackers to escalate privileges and gain full administrative control of the platform. This issue exists in versions prior to 1.0.1 where the system fails to properly validate the existence of administrative accounts before creating new ones, creating a persistent backdoor mechanism that operates after the initial instance claiming process has been completed. The flaw specifically targets the `/setup/create-admin-account` endpoint which accepts unauthenticated POST requests and creates GLOBAL_ADMIN accounts without verifying whether an administrator already exists within the system.
The technical implementation of this vulnerability stems from a race condition in the form processing logic where the application's security checks occur only during GET requests but not during POST operations. While the setup page properly redirects authenticated users away from the configuration interface, the default form action handler bypasses this protection by directly creating user accounts without revalidating whether an admin account already exists. This design flaw allows attackers to submit a simple POST request that creates a new administrative account with elevated privileges immediately upon submission. Each newly created account is initialized with `is_active=true` and `confirmation_state=ACCESS_GRANTED`, meaning no additional verification steps are required for the attacker to gain immediate access to all administrative functions.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it enables attackers to establish persistent access to the platform without requiring any prior authentication credentials or knowledge of existing admin accounts. The lack of rate limiting combined with the automatic activation of new accounts means that multiple administrators can be created in rapid succession, providing attackers with multiple access points and increasing their ability to maintain control over the system. Furthermore, since email confirmation is not required for these accounts, the attacker gains immediate access to all administrative functions including user management, system configuration changes, and potentially sensitive data access. This vulnerability affects the platform's core security model by undermining the fundamental assumption that only legitimate administrators can create new administrative accounts.
The security implications of this flaw align with CWE-306 (Missing Authentication for Critical Function) and represent a clear violation of the principle of least privilege in software security design. Attackers can leverage this vulnerability through simple HTTP POST requests without requiring any sophisticated attack vectors or prior system access, making it particularly dangerous as it can be exploited by anyone who can submit form data to the vulnerable endpoint. The fact that browser-based CSRF protection is bypassed by tools that can supply matching Origin headers demonstrates how inadequate security controls can be circumvented through automated exploitation methods commonly used by security researchers and malicious actors alike. This vulnerability also violates standard security practices for web application development where critical functions should require authentication and authorization checks regardless of the request method or source. Organizations using affected versions of OpenReception should immediately implement patch management procedures to upgrade to version 1.0.1, which addresses this specific security flaw by implementing proper administrative account validation and rate limiting mechanisms. The vulnerability's exploitation does not require any additional preconditions beyond network access to the target system, making it a particularly concerning issue for organizations that rely on OpenReception for their appointment booking services and may be exposed to unauthorized administrative access.