CVE-2026-48085

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.1

Description An issue exists where a fully provisioned instance accepts unauthenticated POST requests to the /setup/create-admin-account endpoint. The system creates additional GLOBAL ADMIN accounts without verifying if an administrator already exists, allowing an unauthenticated network attacker to gain full platform-level administrative control. The created accounts are immediately active with is active=true and confirmation state=ACCESS GRANTED, bypassing email confirmation. This occurs because the layout-level guard only redirects GET requests, while the default form action handler fails to recheck the adminExists() function. While SvelteKit's built-in same-origin check prevents browser-based CSRF, the restriction is bypassed by tools that can supply a matching Origin header.

Recommendations Upgrade to version 1.0.1.