Headline
GHSA-m449-vh5f-574g: OneUptime Unauthorized User Creation via API
Summary
A low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface.
PoC
A low-permission user sends a crafted API request to the user-creation endpoint and the system creates the account successfully.
Impact
This allows attackers to create unauthorized accounts.
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2025-65966
OneUptime Unauthorized User Creation via API
High severity GitHub Reviewed Published Nov 26, 2025 in OneUptime/oneuptime • Updated Nov 26, 2025
Package
npm @oneuptime/common (npm)
Affected versions
< 9.1.0
Summary
A low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface.
PoC
A low-permission user sends a crafted API request to the user-creation endpoint and the system creates the account successfully.
Impact
This allows attackers to create unauthorized accounts.
References
- GHSA-m449-vh5f-574g
- OneUptime/oneuptime@07bc6d4
Published to the GitHub Advisory Database
Nov 26, 2025
Last updated
Nov 26, 2025