Description
A low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface.
Recommendation
Update the @oneuptime/common package to the latest compatible version. Followings are version details:
- Affected version(s): < 9.1.0
- Patched version(s): 9.1.0
References
Related Issues
- OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation - CVE-2025-66028
- Unauthorized Access to Private Fields in User Registration API - @strapi/plugin-users-permissions - CVE-2023-39345
- OneUptime: Synthetic Monitor RCE via exposed Playwright browser object - CVE-2026-30921
- Unauthorized Access to Private Fields in User Registration API - CVE-2023-39345
You might also like:
- Tags:
- npm
- @oneuptime/common
Anything's wrong? Let us know Last updated on December 01, 2025