CVE-2025-65966
CVE-2025-65966 · OneUptime Unauthorized User Creation via API
This page contains facts from public vulnerability sources. Check the original advisory before updating.
OneUptime is a solution for monitoring and managing online services. In version 9.0.5598, a low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface. This issue has been patched in version 9.1.0.
CVSS 8.8 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
oneuptime
- Versions
- = 9.0.5598: Affected
No fix published
@oneuptime/common npm
- Affected ranges
- SEMVER: < 9.1.0
Update to 9.1.0