Read the docs
TI-2025-40554 Aliases CVE-2025-66028GHSA-675q-66gf-gqg8

OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation

Priority HIGH 70CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

OneUptime is a solution for monitoring and managing online services. Prior to version 8.0.5567, OneUptime is vulnerable to privilege escalation via Login Response Manipulation. During the login process, the server response included a parameter called isMasterAdmin. By intercepting and modifying this parameter value from false to true, it is possible to gain access to the admin dashboard interface. However, an attacker may be unable to view or interact with the data if they still do not have sufficient permissions. This issue has been patched in version 8.0.5567.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00324 25th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed oneuptime (OneUptime): 8.0.5567@oneuptime/common (npm): 8.0.5567

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OneUptimeoneuptimebefore 8.0.55678.0.5567Patch availableCNA
—@oneuptime/common (npm)before 8.0.55678.0.5567Patch availableGHSA-675q-66gf-gqg8
  • oneuptime VendorOneUptime Affected before 8.0.5567 Fixed in 8.0.5567 Patch available CNA
  • @oneuptime/common (npm) Vendor— Affected before 8.0.5567 Fixed in 8.0.5567 Patch available GHSA-675q-66gf-gqg8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*before 8.0.5567VulnerableOneUptime
  • cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:* Versions before 8.0.5567 Vulnerable ·OneUptime

Remediation

  • Fix · CNA oneuptime (OneUptime) Fixed in 8.0.5567
  • Fix · GHSA-675q-66gf-gqg8 @oneuptime/common (npm) Fixed in 8.0.5567 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66028
  2. 2026-10-03 Alias added: GHSA-675q-66gf-gqg8

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-22090 OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() CVSS 3.1CRITICAL 10.0
  • TI-2026-27002 OneUptime: Missing Authentication on Notification Endpoints CVSS 3.1CRITICAL 9.1
  • TI-2026-25573 OneUptime: WhatsApp Webhook Missing Signature Verification CVSS 4.0HIGH 8.7
  • TI-2025-40534 OneUptime Unauthorized User Creation via API CVSS 4.0HIGH 8.8
  • TI-2026-25793 Protection mechanism failure in oneuptime CVSS 3.1CRITICAL 10.0
  • TI-2026-24835 OneUptime ClickHouse SQL Injection via Aggregate Query Parameters CVSS 3.1CRITICAL 10.0
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences