EUVD-2026-54167Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate reachable claimed OpenReception instance
-
DeliveryCraft POST to /setup/create-admin-account with matching Origin
-
ExploitServer creates active GLOBAL_ADMIN, bypassing auth check
-
ExecutionLog in with new admin credentials
-
ImpactFull platform control and tenant enumeration
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The instance must be fully provisioned and already claimed/configured (the bug is specifically the post-claim window, distinct from the documented deployment race condition). Exploitation requires only an unauthenticated POST to |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) accurately reflects a trivially reachable, unauthenticated network endpoint that yields total administrative compromise. The description confirms no additional preconditions beyond supplying a matching Origin header - achievable with curl, Burp, or any scanner - and testing created three admins in succession with no rate limiting, reinforcing high automatability. No EPSS score, KEV listing, or POC was provided, so real-world exploitation frequency is unknown; however, the low complexity and complete impact mean any exposed, claimed instance should be treated as high priority. The only signal tempering urgency is product prevalence: OpenReception is a niche open-source project, so this is more likely to be opportunistically scanned than mass-exploited at scale. |
| Exploit ScenarioDerived | An attacker discovers a live, claimed OpenReception instance and sends a crafted POST to |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 06, 2026
Missing authorization in OpenReception's appointment booking platform (before 1.0.1) lets any unauthenticated network attacker POST to /setup/create-admin-account and mint additional GLOBAL_ADMIN accounts on an already-claimed, fully configured instance. The created account is immediately active (is_active=true, confirmation_state=ACCESS_GRANTED) with no email confirmation, granting full platform-level administrative control and successful login and tenant enumeration. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the root cause is confirmed by the vendor GHSA advisory and fix commit.
RemediationAI
Vendor-released patch: upgrade to OpenReception 1.0.1, which adds an adminExists() guard to the create-admin-account POST action and returns HTTP 403 when an admin already exists (fix commit https://github.com/open-reception/appointment-booking-software/commit/222408af6fd4bd85554a25ec8de8131bd0733797; advisory https://github.com/open-reception/appointment-booking-software/security/advisories/GHSA-qvvq-hhpj-64rp). Until the upgrade is applied, restrict network access to the /setup/create-admin-account endpoint at a reverse proxy or WAF (block or deny POST to /setup/* for claimed instances), which is safe because setup should not be reachable post-claim but will break re-provisioning if you ever need it. As a detective control, monitor application logs and databases for unexpected GLOBAL_ADMIN row creations, since the code only emits a standard [error] line on a uniqueness conflict and has no dedicated security event for post-claim admin creation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenReception is a SvelteKit-based, end-to-end encrypted appointment booking web application. The flaw is a classic CWE-862 Missing Authorization: the setup route's layout guard only redirects on GET requests when an admin already exists, but the default form action handler creates the user without re-calling adminExists(). The fix commit (222408a) adds exactly this check to the POST action, returning HTTP 403 when an admin is already present. SvelteKit's built-in same-origin/Origin check does block browser drive-by CSRF, so despite the 'CSRF' tag this is fundamentally a broken-access-control bug on a state-changing endpoint rather than a true cross-site request forgery.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network POST with only a matching Origin header (AV:N/AC:L/PR:N/UI:N) creates an active global admin, yielding full confidentiality, integrity, and availability compromise.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBAL_ADMIN accounts without verifying that an admin already exists. Any unauthenticated network attacker who can submit a same-origin form POST gains full platform-level administrative control. The newly created account is is_active=true with confirmation_state=ACCESS_GRANTED and does not require completing email confirmation; the GLOBAL_ADMIN row is created active and immediately usable. Login and tenant enumeration succeed without any further interaction. This is distinct from the deployment race condition already documented on the Claiming an instance page. That documented race covers the window between deployment and first claim. The bug reported here works after the operator has properly claimed and configured the instance: the layout-level guard that protects the setup page only redirects on GET, while the default form action handler creates the user without rechecking adminExists(). Three GLOBAL_ADMIN accounts were created in succession during testing, with no rate limiting observed. Audit-specific event logging beyond standard application logs was not assessed; the standard [error] line that surfaces only when a uniqueness conflict is hit is not the same as a security event for "additional admin created post-claim". The form post is rejected for browser drive-by CSRF by SvelteKit's built-in same-origin check, but any tool that supplies a matching Origin header (curl, Burp, automated scanners, server-side proxies) bypasses this trivially. No additional preconditions exist. Users should upgrade to version 1.0.1 to receive a patch.
Executive ViewAI
OpenReception's appointment booking platform (versions before 1.0.1) contains a critical authorization bypass that allows any unauthenticated network attacker to create administrator accounts and gain full platform control without credentials or email verification. No public exploit has been identified at time of analysis. Organizations using OpenReception face immediate risk of unauthorized administrative access, complete data exposure, and operational compromise.
No vendor-released patch identified at time of analysis. Implement network segmentation to isolate OpenReception instances from external networks; deploy Web Application Firewall (WAF) rules to block POST requests to /setup/create-admin-account from untrusted sources; restrict administrative access to internal networks only; enable comprehensive audit logging for administrative account creation and authentication events; establish real-time alerting for GLOBAL_ADMIN account creation; consider deployment behind VPN or authentication proxy if operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB