GitHub Advisoryadvisory · npm

GHSA-675q-66gf-gqg8 OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation

MEDIUM Published 2025-11-25 Modified 2025-11-27 Official page ↗
Aliases
CVE-2025-66028
Ecosystem
npm
Packages
@oneuptime/common
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-284, CWE-863
Reviewed
2025-11-25

Affected packages

• npm @oneuptime/common: < 8.0.5567 → fixed in 8.0.5567

Description

Summary During the login process, the server response included a parameter called isMasterAdmin. By intercepting and modifying this parameter value from false to true, a user is able to gain access to the admin dashboard interface. However, despite accessing the admin panel, the user does not have sufficient permissions to view or interact with actual data. PoC Intercept the login response and change "isMasterAdmin": false → "isMasterAdmin": true Impact The admin dashboard is viewable.

Related

Alias · CVE (1)

  • CVE-2025-66028 OneUptime is a solution for monitoring and managing online services. vulnerability

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-863 Incorrect Authorization weakness

References