CVE-2025-66028
BaseFortify
Publication date: 2025-11-26
Last updated on: 2025-12-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hackerbay | oneuptime | to 8.0.5567 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
Upgrade OneUptime to version 8.0.5567 or later, where the privilege escalation vulnerability via Login Response Manipulation has been patched.
Can you explain this vulnerability to me?
This vulnerability in OneUptime prior to version 8.0.5567 allows an attacker to escalate privileges by manipulating the login response. Specifically, the server response includes a parameter called isMasterAdmin, which indicates admin status. An attacker can intercept the login response and change this parameter from false to true, potentially gaining access to the admin dashboard interface. However, if the attacker lacks sufficient permissions, they may not be able to view or interact with the data.
How can this vulnerability impact me? :
The vulnerability can allow an unauthorized user to gain access to the admin dashboard of OneUptime by manipulating the login response. This could lead to unauthorized access to administrative functions and potentially sensitive information, depending on the permissions of the attacker. However, if the attacker does not have sufficient permissions, their ability to view or interact with data may be limited.