CVE-2026-48085 open-reception CVE debrief

Who should care

Users of OpenReception's appointment booking software, administrators, and security teams should be aware of this critical vulnerability and take immediate action to upgrade to version 1.0.1. They should verify instance configuration and admin accounts, and monitor for suspicious activity. This vulnerability provides full platform-level administrative control to an attacker, making it critical for those who manage or use OpenReception's software to address this issue promptly. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions, retest remediated assets, and close the item only after evidence is documented. Operators should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. They should also review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Monitoring, detection, and logs for exposed assets need extra review. Asset inventory and source tracking are also crucial in managing this vulnerability effectively. Rolling back change windows and implementing compensating controls can help mitigate the risk until a patch is applied. The vulnerability's impact on the operator, platform, vulnerability management, and security teams necessitates a comprehensive review of current configurations and defenses. Immediate action is required to prevent unauthorized access and potential data breaches. Therefore, it is essential for all stakeholders to assess their exposure and take appropriate measures to secure their systems against this critical vulnerability. Security teams should also consider the deployment race condition already documented on the Claiming an instance page, although this bug works after the operator has properly claimed and configured the instance. The bug's exploitation could lead to significant security breaches if not addressed promptly and effectively. Hence, a thorough review of the current security posture and immediate remediation efforts are vital

Technical summary

The vulnerability allows unauthenticated POST requests to /setup/create-admin-account, creating additional GLOBAL_ADMIN accounts without verifying that an admin already exists. This issue was fixed in version 1.0.1. The newly created account is is_active=true with confirmation_state=ACCESS_GRANTED and does not require completing email confirmation; the GLOBAL_ADMIN row is created active and immediately usable. Login and tenant enumeration succeed without any further interaction.

Defensive priority

Critical vulnerability in OpenReception's appointment booking software allows unauthenticated creation of GLOBAL_ADMIN accounts, granting full platform-level administrative control.

Recommended defensive actions

• Upgrade to version 1.0.1 to receive a patch
• Verify instance configuration and admin accounts
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability allows unauthenticated POST requests to /setup/create-admin-account, creating additional GLOBAL_ADMIN accounts without verifying that an admin already exists. This issue was fixed in version 1.0.1.

Official resources