CVE-2026-48085

{
  "id": "CVE-2026-48085",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-06T22:17:11.440",
  "lastModified": "2026-10-23T21:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to `/setup/create-admin-account` and creates additional GLOBAL_ADMIN accounts without verifying that an admin already exists. Any unauthenticated network attacker who can submit a same-origin form POST gains full platform-level administrative control. The newly created account is `is_active=true` with `confirmation_state=ACCESS_GRANTED` and does not require completing email confirmation; the GLOBAL_ADMIN row is created active and immediately usable. Login and tenant enumeration succeed without any further interaction. This is distinct from the deployment race condition already documented on the `Claiming an instance` page. That documented race covers the window between deployment and first claim. The bug reported here works after the operator has properly claimed and configured the instance: the layout-level guard that protects the setup page only redirects on GET, while the `default` form action handler creates the user without rechecking `adminExists()`. Three GLOBAL_ADMIN accounts were created in succession during testing, with no rate limiting observed. Audit-specific event logging beyond standard application logs was not assessed; the standard `[error]` line that surfaces only when a uniqueness conflict is hit is not the same as a security event for \"additional admin created post-claim\". The form post is rejected for browser drive-by CSRF by SvelteKit's built-in same-origin check, but any tool that supplies a matching `Origin` header (curl, Burp, automated scanners, server-side proxies) bypasses this trivially. No additional preconditions exist. Users should upgrade to version 1.0.1 to receive a patch."
    },
    {
      "lang": "es",
      "value": "El software de reserva de citas de OpenReception proporciona una plataforma de reserva de citas cifrada de extremo a extremo. Antes de la versión 1.0.1, una instancia de OpenReception completamente aprovisionada acepta solicitudes POST no autenticadas a “/setup/create-admin-account” y crea cuentas GLOBAL_ADMIN adicionales sin verificar que ya exista un administrador. Cualquier atacante de red no autenticado que pueda enviar un POST de formulario del mismo origen obtiene control administrativo completo a nivel de plataforma. La cuenta recién creada es “is_active=true” con “confirmation_state=ACCESS_GRANTED” y no requiere completar la confirmación por correo electrónico; la fila GLOBAL_ADMIN se crea activa e inmediatamente utilizable. El inicio de sesión y la enumeración de inquilinos se realizan con éxito sin ninguna interacción adicional. Esto es distinto de la condición de carrera de despliegue ya documentada en la página ’Claiming an instance’. Esa condición de carrera documentada cubre la ventana entre el despliegue y la primera reclamación. El error aquí reportado funciona después de que el operador ha reclamado y configurado correctamente la instancia: el guard a nivel de diseño que protege la página de configuración solo redirige en GET, mientras que el gestor de acción de formulario “default” crea el usuario sin volver a verificar “adminExists()”. Se crearon tres cuentas GLOBAL_ADMIN sucesivamente durante las pruebas, sin observarse limitación de velocidad. No se evaluó el registro de eventos específico de auditoría más allá de los registros de aplicación estándar; la línea “[error]” estándar que aparece solo cuando se produce un conflicto de unicidad no es lo mismo que un evento de seguridad para ’administrador adicional creado post-reclamación’. El POST del formulario es rechazado para CSRF de tipo ’drive-by’ en el navegador por la verificación de mismo origen incorporada de SvelteKit, pero cualquier herramienta que proporcione un encabezado “Origin” coincidente (curl, Burp, escáneres automatizados, proxies del servidor) lo elude trivialmente. No existen precondiciones adicionales. Los usuarios deben actualizar a la versión 1.0.1 para recibir un parche."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "open-reception",
          "product": "appointment-booking-software",
          "versions": [
            {
              "version": "< 1.0.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-07T15:37:56.257398Z",
          "id": "CVE-2026-48085",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/open-reception/appointment-booking-software/commit/222408af6fd4bd85554a25ec8de8131bd0733797",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-qvvq-hhpj-64rp",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-qvvq-hhpj-64rp",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}