BaseFortify

Publication date: 2025-11-26

Last updated on: 2025-12-05

Assigner: GitHub, Inc.

Description

OneUptime is a solution for monitoring and managing online services. Prior to version 8.0.5567, OneUptime is vulnerable to privilege escalation via Login Response Manipulation. During the login process, the server response included a parameter called isMasterAdmin. By intercepting and modifying this parameter value from false to true, it is possible to gain access to the admin dashboard interface. However, an attacker may be unable to view or interact with the data if they still do not have sufficient permissions. This issue has been patched in version 8.0.5567.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-26

Last Modified

2025-12-05

Generated

2026-07-06

AI Q&A

2025-11-26

EPSS Evaluated

2026-07-05

NVD

CVE-2025-66028

Affected Vendors & Products

Vendor	Product	Version / Range
hackerbay	oneuptime	to 8.0.5567 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability in OneUptime prior to version 8.0.5567 allows an attacker to escalate privileges by manipulating the login response. Specifically, the server response includes a parameter called isMasterAdmin, which indicates admin status. An attacker can intercept the login response and change this parameter from false to true, potentially gaining access to the admin dashboard interface. However, if the attacker lacks sufficient permissions, they may not be able to view or interact with the data.

Mitigation Strategies

Upgrade OneUptime to version 8.0.5567 or later, where the privilege escalation vulnerability via Login Response Manipulation has been patched.

Impact Analysis

The vulnerability can allow an unauthorized user to gain access to the admin dashboard of OneUptime by manipulating the login response. This could lead to unauthorized access to administrative functions and potentially sensitive information, depending on the permissions of the attacker. However, if the attacker does not have sufficient permissions, their ability to view or interact with data may be limited.

Hi! I’m here to help you understand CVE-2025-66028. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70