Executive brief
OneUptime is an open-source monitoring and incident management platform. During login, attackers can intercept the authentication response and modify a flag that grants access to the admin dashboard, potentially exposing sensitive monitoring configuration and infrastructure data. Although actual data access controls limit further damage, the admin interface exposure represents a significant security boundary bypass.
Technical details
The vulnerability is an improper access control issue (CWE-284, CWE-863) in the login response handling. The server includes an "isMasterAdmin" boolean parameter in the authentication response that determines dashboard access level. An attacker with network access can intercept the response and change this value from false to true, bypassing client-side privilege checks. The attack requires no authentication credentials and is network-reachable. While backend data access controls prevent full compromise, the attacker gains unauthorized visibility into the admin interface and configuration. The vulnerability is fixed in version 8.0.5567.
Affected products
- OneUptime OneUptime before 8.0.5567
Timeline
- 2025-11-25: disclosed: Advisory published as GHSA-675q-66gf-gqg8
- 2025-11-25: patched: Fix available in version 8.0.5567 (commit 3e72b2a9a4f50f98cf1f6cf13fa3e405715bb370)