CVE-2026-48085 open-reception CVE debrief

Who should care

Defenders and administrators of OpenReception appointment booking software instances should assess exposure and prioritize upgrading to version 1.0.1. They should verify instance configurations, monitor for unusual activity, and review compensating controls for exposed systems.

Why it matters

CVE-2026-48085 allows unauthenticated network attackers to gain full platform-level administrative control of OpenReception appointment booking software instances prior to version 1.0.1.

• Unauthenticated administrative control allows for full platform-level access
• Creation of additional GLOBAL_ADMIN accounts without verification
• Potential for exploitation by network attackers

Technical summary

OpenReception's appointment booking software prior to version 1.0.1 accepts unauthenticated POST requests to `/setup/create-admin-account`, creating additional GLOBAL_ADMIN accounts without verification. This allows unauthenticated network attackers to gain full platform-level administrative control. The newly created account is active with `confirmation_state=ACCESS_GRANTED` and does not require email confirmation. The layout-level guard protects the setup page only on GET requests, while the default form action handler creates the user without rechecking `adminExists()`.

Defensive priority

Defenders should prioritize upgrading to version 1.0.1 and verify instance configurations.

Recommended defensive actions

• Upgrade to version 1.0.1
• Verify instance configurations
• Monitor for unusual activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability. GitHub references offer source-specific details. The vulnerability allows unauthenticated network attackers to create additional GLOBAL_ADMIN accounts without verification. Supplied source corpus details indicate no additional preconditions exist. The form post is rejected for browser drive-by CSRF by SvelteKit's built-in same-origin check, but tools like curl or Burp bypass this. Users should verify instance configurations and monitor for usual

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.