External risk intelligence

OpenReception Unauthenticated Admin Account Creation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-48085

The software is an appointment booking platform, a category of application commonly deployed as an internet-facing web service to allow external users to schedule appointments. Because it is designed to be accessible to the public, the administrative setup and management endpoints are often exposed if not strictly restricted by network-level controls.

Cross-site Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

OpenReception's appointment booking software has a critical vulnerability that allows unauthenticated attackers to create new administrative accounts and gain full control of the platform. This issue affects instances prior to version 1.0.1 and could allow unauthorized users to access and manipulate appointment data. The main concern is confirming relevance and exposure to this type of platform.

Attackers can seize administrative control of booking software.
It allows unauthorized access to sensitive booking information.
Confirm if this booking software is in use.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker on the network can gain full administrative control of an OpenReception instance by sending a specially crafted POST request to the `/setup/create-admin-account` endpoint. This bypasses existing security checks after the initial setup, allowing the attacker to create new administrator accounts without proper verification. The vulnerability can lead to complete compromise of the platform.

Attacker can access the vulnerable endpoint remotely.
Sending an unauthenticated POST request triggers the vulnerability.
Full administrative control of the platform is the risk.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated network attackers could gain full administrative control over the OpenReception appointment booking platform by exploiting a vulnerability in the account creation process. This could allow them to create additional administrative accounts without proper verification, potentially compromising the entire platform.

Platform administrative control.
Unauthenticated POST requests to `/setup/create-admin-account`.
Full platform-level administrative control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application and infrastructure teams are likely responsible for securing the OpenReception appointment booking software. The initial practical step is to identify all instances, confirm their exposure and criticality, and determine the accountable owner. Planning remediation should then be based on the assessed risk to the business.

Identify affected instances and owners.
Verify network reachability and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenReception appointment booking software?

OpenReception is a platform designed to manage and facilitate end-to-end encrypted appointment scheduling. It functions as a web-based service where organizations host booking calendars, allowing them to coordinate interactions with clients or patients. Because it handles sensitive scheduling data, the platform includes administrative management tools to oversee the instance and user accounts.

What weakness does CVE-2026-48085 involve?

This vulnerability is classified as Missing Authorization (CWE-862). It occurs because the software fails to verify if an administrator already exists when receiving a request to create a new one. By sending a request to the setup endpoint, an attacker can bypass the intended access controls, effectively forcing the application to grant them full administrative privileges even after the platform has been properly configured by the original owner.

How is this vulnerability triggered by an attacker?

An attacker triggers this bug by sending an unauthenticated POST request to the `/setup/create-admin-account` endpoint. The platform lacks a sufficient check to see if an admin is already provisioned, so it proceeds to create a new, active global administrator account. Crucially, simple browser-based requests are blocked by origin checks, but the bug is easily triggered by any tool or script that can supply a valid origin header, such as common command-line utilities.

Why should I worry about this if my app is internal?

Halo Surface Signal indicates that OpenReception is typically deployed as an internet-facing service to facilitate public appointment scheduling. While the software might be internal-only in some configurations, the risk remains high if the `/setup` endpoint is reachable from anywhere on the network, including public interfaces. If an attacker can reach this endpoint, they can gain administrative access regardless of whether the broader service is intended for public or internal use.

What is the first step to fix this?

The primary response is to upgrade your OpenReception installation to version 1.0.1 or later. This update addresses the missing authorization logic that allows unauthorized account creation. Before applying the update, confirm your deployment version, identify the specific instances running in your environment, and verify their current network accessibility to prioritize patching accordingly.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.