OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation

Description

A security vulnerability exists in oneuptime’s local storage handling, where a regular user can escalate privileges by modifying the is_master_admin key to true. This allows unauthorized access to administrative functionalities.

Recommendation

Update the @oneuptime/model package to the latest compatible version. Followings are version details:

• Affected version(s): < 7.0.1815
• Patched version(s): 7.0.1815

References

• GHSA-246p-xmg8-wmcq
• CVE-2024-29194
• CWE-639
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation - CVE-2025-66028
• Cube Core is vulnerable to privilege escalation via a specially crafted request - CVE-2026-25958
• steal vulnerable to Prototype Pollution via key variable in babel.js - CVE-2022-37266
• jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext - CVE-2024-28176

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@oneuptime/model