CVE-2025-65966: OneUptime Unauthorized User Creation via API
Summary A low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface.
PoC A low-permission user sends a crafted API request to the user-creation endpoint and the system creates the account successfully. !WhatsApp Image 2025-11-23 at 14 27 320e0f5889
Impact This allows attackers to create unauthorized accounts.
Other sources
OneUptime is a solution for monitoring and managing online services. In version 9.0.5598, a low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface. This issue has been patched in version 9.1.0.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65966?
CVE-2025-65966 is classified with a low severity rating due to its limited impact and exploitation requirements.
How do I fix CVE-2025-65966?
To fix CVE-2025-65966, upgrade OneUptime to version 9.1.0 or later.
What kinds of accounts can be created due to CVE-2025-65966?
CVE-2025-65966 allows low-permission users to create new accounts through a direct API request.
What is the affected version of OneUptime for CVE-2025-65966?
CVE-2025-65966 affects OneUptime versions prior to 9.1.0.
Who is affected by CVE-2025-65966?
Any user with low permissions in OneUptime versions before 9.1.0 is potentially affected by CVE-2025-65966.