CVE-2026-48085
OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap
Description
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to `/setup/create-admin-account` and creates additional GLOBAL_ADMIN accounts without verifying that an admin already exists. Any unauthenticated network attacker who can submit a same-origin form POST gains full platform-level administrative control. The newly created account is `is_active=true` with `confirmation_state=ACCESS_GRANTED` and does not require completing email confirmation; the GLOBAL_ADMIN row is created active and immediately usable. Login and tenant enumeration succeed without any further interaction. This is distinct from the deployment race condition already documented on the `Claiming an instance` page. That documented race covers the window between deployment and first claim. The bug reported here works after the operator has properly claimed and configured the instance: the layout-level guard that protects the setup page only redirects on GET, while the `default` form action handler creates the user without rechecking `adminExists()`. Three GLOBAL_ADMIN accounts were created in succession during testing, with no rate limiting observed. Audit-specific event logging beyond standard application logs was not assessed; the standard `[error]` line that surfaces only when a uniqueness conflict is hit is not the same as a security event for "additional admin created post-claim". The form post is rejected for browser drive-by CSRF by SvelteKit's built-in same-origin check, but any tool that supplies a matching `Origin` header (curl, Burp, automated scanners, server-side proxies) bypasses this trivially. No additional preconditions exist. Users should upgrade to version 1.0.1 to receive a patch.
INFO
Published Date :
Aug. 6, 2026, 10:17 p.m.
Last Modified :
Oct. 23, 2026, 9:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-48085
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | CRITICAL | [email protected] | ||||
| CVSS 3.1 | CRITICAL | MITRE-CVE |
Solution
- Upgrade OpenReception to version 1.0.1.
- Ensure admin account creation is properly protected.
- Monitor for unauthorized account creation.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-48085.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-48085 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-48085
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-48085 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-48085 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Added Translation Title: appointment-booking-software de open-reception, Description: El software de reserva de citas de OpenReception proporciona una plataforma de reserva de citas cifrada de extremo a extremo. Antes de la versión 1.0.1, una instancia de OpenReception completamente aprovisionada acepta solicitudes POST no autenticadas a “/setup/create-admin-account” y crea cuentas GLOBAL_ADMIN adicionales sin verificar que ya exista un administrador. Cualquier atacante de red no autenticado que pueda enviar un POST de formulario del mismo origen obtiene control administrativo completo a nivel de plataforma. La cuenta recién creada es “is_active=true” con “confirmation_state=ACCESS_GRANTED” y no requiere completar la confirmación por correo electrónico; la fila GLOBAL_ADMIN se crea activa e inmediatamente utilizable. El inicio de sesión y la enumeración de inquilinos se realizan con éxito sin ninguna interacción adicional. Esto es distinto de la condición de carrera de despliegue ya documentada en la página ’Claiming an instance’. Esa condición de carrera documentada cubre la ventana entre el despliegue y la primera reclamación. El error aquí reportado funciona después de que el operador ha reclamado y configurado correctamente la instancia: el guard a nivel de diseño que protege la página de configuración solo redirige en GET, mientras que el gestor de acción de formulario “default” crea el usuario sin volver a verificar “adminExists()”. Se crearon tres cuentas GLOBAL_ADMIN sucesivamente durante las pruebas, sin observarse limitación de velocidad. No se evaluó el registro de eventos específico de auditoría más allá de los registros de aplicación estándar; la línea “[error]” estándar que aparece solo cuando se produce un conflicto de unicidad no es lo mismo que un evento de seguridad para ’administrador adicional creado post-reclamación’. El POST del formulario es rechazado para CSRF de tipo ’drive-by’ en el navegador por la verificación de mismo origen incorporada de SvelteKit, pero cualquier herramienta que proporcione un encabezado “Origin” coincidente (curl, Burp, escáneres automatizados, proxies del servidor) lo elude trivialmente. No existen precondiciones adicionales. Los usuarios deben actualizar a la versión 1.0.1 para recibir un parche. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 07, 2026
Action Type Old Value New Value Added Reference https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-qvvq-hhpj-64rp Added SSVC {'id': 'CVE-2026-48085', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-08-07T15:37:56.257398Z'} -
New CVE Received by [email protected]
Aug. 06, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'open-reception', 'product': 'appointment-booking-software', 'versions': [{'status': 'affected', 'version': '< 1.0.1'}]}] Added Description OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to `/setup/create-admin-account` and creates additional GLOBAL_ADMIN accounts without verifying that an admin already exists. Any unauthenticated network attacker who can submit a same-origin form POST gains full platform-level administrative control. The newly created account is `is_active=true` with `confirmation_state=ACCESS_GRANTED` and does not require completing email confirmation; the GLOBAL_ADMIN row is created active and immediately usable. Login and tenant enumeration succeed without any further interaction. This is distinct from the deployment race condition already documented on the `Claiming an instance` page. That documented race covers the window between deployment and first claim. The bug reported here works after the operator has properly claimed and configured the instance: the layout-level guard that protects the setup page only redirects on GET, while the `default` form action handler creates the user without rechecking `adminExists()`. Three GLOBAL_ADMIN accounts were created in succession during testing, with no rate limiting observed. Audit-specific event logging beyond standard application logs was not assessed; the standard `[error]` line that surfaces only when a uniqueness conflict is hit is not the same as a security event for "additional admin created post-claim". The form post is rejected for browser drive-by CSRF by SvelteKit's built-in same-origin check, but any tool that supplies a matching `Origin` header (curl, Burp, automated scanners, server-side proxies) bypasses this trivially. No additional preconditions exist. Users should upgrade to version 1.0.1 to receive a patch. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-862 Added Reference https://github.com/open-reception/appointment-booking-software/commit/222408af6fd4bd85554a25ec8de8131bd0733797 Added Reference https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-qvvq-hhpj-64rp