Overview
CVE-2025-65966 describes a vulnerability in OneUptime version 9.0.5598, a solution designed for monitoring and managing online services. This vulnerability allows users with low privileges to bypass the intended account creation interface and directly create new accounts via API requests. This could potentially lead to unauthorized access and resource manipulation.
Technical Details
In OneUptime version 9.0.5598, the account creation process implemented insufficient access control checks on the API endpoint responsible for creating new accounts. A low-permission user, by crafting a specific API request, could successfully create new user accounts without proper authorization. This circumvents the intended account creation workflow, which likely involves stricter validation and permission checks.
The vulnerability lies in the lack of proper authentication and authorization verification when handling API requests for user account creation. By directly interacting with the vulnerable API endpoint, users can bypass the usual controls implemented within the OneUptime platform’s user interface.
CVSS Analysis
As of the published date of this advisory (2025-11-26), a CVSS score and severity rating are listed as “N/A”. This likely indicates that the score was still being calculated or that the specific factors for determining the score were not fully available at the time of disclosure. However, the lack of a score does not diminish the importance of addressing this vulnerability.
Possible Impact
The potential impact of CVE-2025-65966 includes:
- Unauthorized Account Creation: Attackers could create numerous accounts, potentially exhausting resources or disrupting services.
- Privilege Escalation: Newly created accounts could potentially be used to gain further access to the system, depending on the default permissions assigned to new users.
- Data Breach or Manipulation: Depending on the resources and functionalities accessible to these newly created accounts, attackers could potentially access or manipulate sensitive data.
- Denial of Service (DoS): A large number of rogue accounts could be used to overwhelm the system and cause a denial of service for legitimate users.
Mitigation or Patch Steps
The vulnerability has been patched in OneUptime version 9.1.0. It is strongly recommended to upgrade to this version or a later version as soon as possible.
- Upgrade OneUptime: Follow the official OneUptime upgrade instructions to update your installation to version 9.1.0 or later.
- Verify Configuration: After upgrading, review your OneUptime configuration to ensure that proper access control settings are in place.
- Monitor for Suspicious Activity: Monitor your OneUptime instance for any unusual account creation activity or other signs of exploitation.
