high8.8
CVE-2025-65966
OneUptime Unauthorized User Creation via API
Impact
### Summary A low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface. ### PoC A low-permission user sends a crafted API request to the user-creation endpoint and the system creates the account successfully.  ### Impact This allows attackers to create unauthorized accounts.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @oneuptime/common | < 9.1.0 | 9.1.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hackerbay | Oneuptime | Version 9.0.5598 |