CVE-2026-48085 is a critical authorization bypass vulnerability in OpenReception appointment booking software before version 1.0.1. The vulnerability allows unauthenticated network attackers to send POST requests to the /setup/create-admin-account endpoint and create additional GLOBAL_ADMIN accounts without verifying if an admin already exists. The created accounts are active immediately with full administrative privileges and do not require email confirmation. The vulnerability exists because the setup page's layout-level guard only redirects on GET requests, while the POST handler does not recheck admin existence. This enables attackers to gain full platform control post-deployment. No rate limiting or additional preconditions exist, and the built-in same-origin check can be trivially bypassed by tools that supply a matching Origin header. Users are advised to upgrade to version 1.0.1 where this issue is patched.

An unauthenticated attacker can gain full administrative control over the OpenReception platform by creating active global admin accounts without any verification or email confirmation. This compromises confidentiality, integrity, and availability of the system. The vulnerability allows complete takeover of the appointment booking software instance, potentially leading to unauthorized data access, manipulation, and service disruption.

Upgrade OpenReception appointment booking software to version 1.0.1 or later, where this vulnerability is fixed. No other mitigations are documented. Patch status is confirmed by the vendor advisory stating the fix is included in version 1.0.1.