Read the docs
TI-2024-19363 Aliases CVE-2024-29194GHSA-246p-xmg8-wmcq

OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation

Priority HIGH 71CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

OneUptime is a solution for monitoring and managing online services. The vulnerability lies in the improper validation of client-side stored data within the web application. Specifically, the is_master_admin key, stored in the local storage of the browser, can be manipulated by an attacker. By changing this key from false to true, the application grants administrative privileges to the user, without proper server-side validation. This has been patched in 7.0.1815.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00702 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed oneuptime (OneUptime): 7.0.1815@oneuptime/model (npm): 7.0.1815+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OneUptimeoneuptimebefore 7.0.18157.0.1815Patch availableCNA
—@oneuptime/model (npm)before 7.0.18157.0.1815Patch availableGHSA-246p-xmg8-wmcq
—@oneuptime/common-server (npm)before 7.0.18157.0.1815Patch availableGHSA-246p-xmg8-wmcq
  • oneuptime VendorOneUptime Affected before 7.0.1815 Fixed in 7.0.1815 Patch available CNA
  • @oneuptime/model (npm) Vendor— Affected before 7.0.1815 Fixed in 7.0.1815 Patch available GHSA-246p-xmg8-wmcq
  • @oneuptime/common-server (npm) Vendor— Affected before 7.0.1815 Fixed in 7.0.1815 Patch available GHSA-246p-xmg8-wmcq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*7.0.1803 to before 7.0.1815VulnerableOneUptime
  • cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:* Versions 7.0.1803 to before 7.0.1815 Vulnerable ·OneUptime

Remediation

  • Fix · CNA oneuptime (OneUptime) Fixed in 7.0.1815
  • Fix · GHSA-246p-xmg8-wmcq @oneuptime/model (npm) Fixed in 7.0.1815 Advisory →
  • Fix · GHSA-246p-xmg8-wmcq @oneuptime/common-server (npm) Fixed in 7.0.1815 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-29194
  2. 2026-10-03 Alias added: GHSA-246p-xmg8-wmcq

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-22090 OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() CVSS 3.1CRITICAL 10.0
  • TI-2026-27002 OneUptime: Missing Authentication on Notification Endpoints CVSS 3.1CRITICAL 9.1
  • TI-2026-25573 OneUptime: WhatsApp Webhook Missing Signature Verification CVSS 4.0HIGH 8.7
  • TI-2025-40534 OneUptime Unauthorized User Creation via API CVSS 4.0HIGH 8.8
  • TI-2026-25793 Protection mechanism failure in oneuptime CVSS 3.1CRITICAL 10.0
  • TI-2026-24835 OneUptime ClickHouse SQL Injection via Aggregate Query Parameters CVSS 3.1CRITICAL 10.0
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences