What’s Vulnerable › Vulnerabilities

CVE-2025-66028: OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-11-26 · updated 2026-10-18
• Weakness: CWE-284

Description

OneUptime is a solution for monitoring and managing online services. Prior to version 8.0.5567, OneUptime is vulnerable to privilege escalation via Login Response Manipulation. During the login process, the server response included a parameter called isMasterAdmin. By intercepting and modifying this parameter value from false to true, it is possible to gain access to the admin dashboard interface. However, an attacker may be unable to view or interact with the data if they still do not have sufficient permissions. This issue has been patched in version 8.0.5567.

Affected products

• oneuptime: before 8.0.5567 — fixed in 8.0.5567

How to fix

Upgrade to a fixed version: oneuptime 8.0.5567. Check the vendor advisory for mitigations.

References

• https://github.com/OneUptime/oneuptime/commit/3e72b2a9a4f50f98cf1f6cf13fa3e405715bb370
• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-675q-66gf-gqg8

Get alerted when CVE-2025-66028 or the next vulnerability affects your stack