GHSA-m449-vh5f-574gHigh

OneUptime Unauthorized User Creation via API

Published
November 26, 2025
Last Modified
December 1, 2025

🔗 CVE IDs covered (1)

CVE-2025-65966 →

📋 Description

Summary

A low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface.

PoC

A low-permission user sends a crafted API request to the user-creation endpoint and the system creates the account successfully. WhatsApp Image 2025-11-23 at 14 27 32_0e0f5889

Impact

This allows attackers to create unauthorized accounts.

🎯 Affected products1

  • npm/@oneuptime/common:< 9.1.0

🔗 References (4)