GitHub Advisoryadvisory · npm

GHSA-m449-vh5f-574g OneUptime Unauthorized User Creation via API

HIGH Published 2025-11-26 Modified 2025-12-01 Official page ↗
Aliases
CVE-2025-65966
Ecosystem
npm
Packages
@oneuptime/common
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-285
Reviewed
2025-11-26

Affected packages

• npm @oneuptime/common: < 9.1.0 → fixed in 9.1.0

Description

Summary A low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface. PoC A low-permission user sends a crafted API request to the user-creation endpoint and the system creates the account successfully. Impact This allows attackers to create unauthorized accounts.

Related

Alias · CVE (1)

  • CVE-2025-65966 OneUptime is a solution for monitoring and managing online services. vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References