OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation

Description

During the login process, the server response included a parameter called isMasterAdmin. By intercepting and modifying this parameter value from false to true, a user is able to gain access to the admin dashboard interface.

Recommendation

Update the @oneuptime/common package to the latest compatible version. Followings are version details:

• Affected version(s): < 8.0.5567
• Patched version(s): 8.0.5567

References

• GHSA-675q-66gf-gqg8
• CVE-2025-66028
• CWE-284
• CWE-863
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation - CVE-2024-29194
• OneUptime Unauthorized User Creation via API - CVE-2025-65966
• Cube Core is vulnerable to privilege escalation via a specially crafted request - CVE-2026-25958
• FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection - CVE-2026-43945

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@oneuptime/common