Privilege escalation allows any user to add an administrator

I would like to report privilege escalation in the npm module express-cart.

// set the account to admin if using the setup form. Eg: First user account
let urlParts = url.parse(req.header('Referer'));

let isAdmin = false;
if(urlParts.path === '/admin/setup'){
  isAdmin = true;
}