HIGH

GHSA-m449-vh5f-574g

OneUptime Unauthorized User Creation via API

Quick fix

GHSA-m449-vh5f-574g — @oneuptime/common: upgrade to the fixed version with the command below.

npm install @oneuptime/common@9.1.0

Details

### Summary A low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface.

### PoC A low-permission user sends a crafted API request to the user-creation endpoint and the system creates the account successfully. ![WhatsApp Image 2025-11-23 at 14 27 32_0e0f5889](https://github.com/user-attachments/assets/5a539310-c9a2-4466-8926-b49b9b2a2422)

### Impact This allows attackers to create unauthorized accounts.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/@oneuptime/common

Introduced in: 0Fixed in: 9.1.0

Fixnpm install @oneuptime/common@9.1.0

References

https://github.com/OneUptime/oneuptime/security/advisories/GHSA-m449-vh5f-574g[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2025-65966[ADVISORY]
https://github.com/OneUptime/oneuptime/commit/07bc6d4edde7397ea6b88f889c065ec392052ab4[WEB]
https://github.com/OneUptime/oneuptime[PACKAGE]