A critical missing authorization vulnerability in OpenReception allows unauthenticated attackers to create unauthorized global administrator accounts on fully provisioned instances.

This is a missing authorization vulnerability (CWE-862) where the application fails to verify if an administrator already exists before processing a registration POST request to the setup endpoint. An attacker can bypass simple origin checks to create an active, privileged account.

Successful exploitation allows an unauthenticated attacker to gain immediate and full administrative access to the platform. With a CVSS score of 9.8, this vulnerability poses a severe threat to the entire installation, enabling complete data access and administrative control.

Immediate Action: Update OpenReception appointment-booking-software to version 1.0.1 or later to ensure the setup endpoint correctly validates the existence of administrators before allowing new account creation.

Proactive Monitoring: Monitor system logs for any unexpected account creation events, specifically those involving the creation of new administrator roles.

Compensating Controls: Use a Web Application Firewall (WAF) to restrict access to the /setup/create-admin-account path and ensure the Origin header is validated strictly against trusted domains.

Public Exploit Available: Unknown

This vulnerability provides an unauthenticated attacker with a direct path to administrative control. It is imperative that administrators apply the patch to version 1.0.1 immediately to secure the platform against unauthorized account creation.