A fully provisioned OpenReception instance accepts unauthenticated POST requests to `/setup/create-admin-account` before version 1.0.1, generating active GLOBAL_ADMIN accounts without verifying existing admins. Newly created accounts are immediately active and bypass email confirmation, giving attackers full platform‑level control. The vulnerability allows an adversary to obtain unrestricted administrative privileges without any authentication or authorization checks.

OpenReception appointment booking software, all versions prior to 1.0.1. The flaw affects any deployed instance that has completed the initial claim and configuration, regardless of tenant setup or existing administrators.

The CVSS score is 9.8, indicating critical severity, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is network; any unauthenticated attacker capable of forging a same‑origin POST with a matching Origin header (e.g., curl, Burp, automated scanners) can exploit it. There is no rate limiting or additional preconditions, making exploitation trivial and immediate once the attacker submits the request.