Executive brief
OneUptime is an open-source monitoring and observability platform. A flaw in its API allows low-privileged users to create new user accounts without proper authorization checks, enabling attackers to gain unauthorized access to the system and potentially escalate privileges or compromise data.
Technical details
The vulnerability is an improper authorization check (CWE-285) in the user-creation API endpoint. A low-permission authenticated user can craft a direct API request to bypass the intended interface restrictions and create new user accounts. The attack requires network access to the API and low-level authentication credentials, but no special user interaction. An attacker can successfully create unauthorized accounts, potentially leading to privilege escalation or unauthorized system access. The issue is fixed in version 9.1.0.
Affected products
- OneUptime @oneuptime/common before 9.1.0
Timeline
- 2025-11-26: disclosed
- 2025-11-26: patched: Fixed in version 9.1.0