PT-2025-48172 · Oneuptime · Oneuptime

Published 2025-11-25 · Updated 2026-03-10 · CVE-2025-66028

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions OneUptime versions prior to 8.0.5567

Description OneUptime, a service monitoring solution, contains a flaw that allows for privilege escalation. By altering the isMasterAdmin parameter within the login response, an attacker can potentially gain access to the admin dashboard. While access to data may still be restricted based on existing permissions, the ability to reach the administrative interface is compromised. The affected API endpoint is the login process.

Recommendations Update to version 8.0.5567 or later.

Exploit

Fix

LPE

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-284

Related Identifiers

CVE-2025-66028

GHSA-675Q-66GF-GQG8

Affected Products

Oneuptime

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66028.json · Exploit
• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-675q-66gf-gqg8 · Vendor Advisory
• https://github.com/OneUptime/oneuptime/commit/3e72b2a9a4f50f98cf1f6cf13fa3e405715bb370 · Patch
• https://osv.dev/vulnerability/GHSA-675q-66gf-gqg8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66028 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66028 · Security Note
• https://github.com/OneUptime/oneuptime · Note
• https://twitter.com/dailycve/status/1996973659622191211 · Twitter Post
• https://t.me/CVEtracker/38298 · Telegram Post
• https://t.me/cveNotify/144879 · Telegram Post
• https://twitter.com/dailycve/status/2031226120109002999 · Twitter Post
• https://twitter.com/CVEnew/status/1993753677354381536 · Twitter Post