CVE-2025-65966: OneUptime Unauthorized User Creation via API

November 26, 2025 (updated December 1, 2025)

A low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface.

References

github.com/OneUptime/oneuptime
github.com/OneUptime/oneuptime/commit/07bc6d4edde7397ea6b88f889c065ec392052ab4
github.com/OneUptime/oneuptime/security/advisories/GHSA-m449-vh5f-574g
github.com/advisories/GHSA-m449-vh5f-574g
nvd.nist.gov/vuln/detail/CVE-2025-65966

Code Behaviors & Features

Detect and mitigate CVE-2025-65966 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →