High · published November 27, 2025
⚠️ A sneaky parameter in the login response could let an attacker escalate privileges! Before version 8.0.5567, OneUptime’s response contained an easily manipulable isMasterAdmin setting, putting your admin dashboard at risk. 💥 Think of this like a hotel where the receptionist mistakenly hands out a master key card that opens every room — just a flick of the wrist to change it from 'guest' to 'admin'! If exploited, an attacker could gain access to the admin interface, which might allow them to make changes or manage services without proper credentials. While they might not see sensitive data without additional permissions, the risk of unauthorized access remains a significant concern.
Think of this like a hotel where the receptionist mistakenly hands out a master key card that opens every room — just a flick of the wrist to change it from 'guest' to 'admin'! This vulnerability allows for privilege escalation by intercepting and modifying the isMasterAdmin parameter in the login response, changing its value from false to true, thus gaining access to restricted admin functionalities.
If exploited, an attacker could gain access to the admin interface, which might allow them to make changes or manage services without proper credentials. While they might not see sensitive data without additional permissions, the risk of unauthorized access remains a significant concern. Update OneUptime to version 8.0.5567 immediately to close this loophole. Review your access controls to ensure that proper permissions are enforced, and consider implementing additional security measures like monitoring for unusual login attempts. You've got this! Just patch up, stay vigilant, and you'll keep your admin dashboard safe and sound. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| hackerbay/oneuptime | < 8.0.5567 | 8.0.5567 |