High · published November 27, 2025
⚡ A low-permission user can sneak through the backdoor and create new accounts via the API! 😱 Think of it like a restaurant where a customer slips behind the counter and starts taking orders without the staff even checking their badge. This oversight in OneUptime’s system is allowing the wrong folks to play at being admins! An attacker could maliciously create unauthorized accounts, potentially leading to control of sensitive data and impacting service management. This could disrupt operations and compromise user trust, making it a high-risk situation for any organization reliant on OneUptime.
Think of it like a restaurant where a customer slips behind the counter and starts taking orders without the staff even checking their badge. This oversight in OneUptime’s system is allowing the wrong folks to play at being admins! In version 9.0.5598, the application’s API does not properly restrict account creation to authorized interfaces, allowing low-permission users to bypass security measures.
An attacker could maliciously create unauthorized accounts, potentially leading to control of sensitive data and impacting service management. This could disrupt operations and compromise user trust, making it a high-risk situation for any organization reliant on OneUptime. Immediately upgrade to version 9.1.0 to patch this vulnerability. Additionally, review your permissions and API access policies to prevent unauthorized actions from low-permission accounts. You've got this! Just follow these steps, and you'll tighten up your security in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| hackerbay/oneuptime | all versions | — |