Cloudanix VulnDB

CVE-2025-65966

Critical · 9.1

OneUptime Unauthorized User Creation via API

CVSS

9.1

EPSS

0.3%

Published

Nov 26, 2025

CISA due date

—

The record

A low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface.

Affected packages

Ecosystem Package Introduced Fixed
npm @oneuptime/common 0 9.1.0

Related vulnerabilities