CVE-2025-65966: OneUptime Unauthorized User Creation via API

November 26, 2025 (updated December 1, 2025)

A low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface.

References

github.com/OneUptime/oneuptime
github.com/OneUptime/oneuptime/commit/07bc6d4edde7397ea6b88f889c065ec392052ab4
github.com/OneUptime/oneuptime/security/advisories/GHSA-m449-vh5f-574g
github.com/advisories/GHSA-m449-vh5f-574g
nvd.nist.gov/vuln/detail/CVE-2025-65966

Code Behaviors & Features

Detect and mitigate CVE-2025-65966 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →