CVE-2025-65966 HIGH

CVE-2025-65966: OneUptime Unauthorized User Creation via API

Vendor Oneuptime
Product oneuptime
Weakness CWE-285
Published November 26, 2025
Last update November 26, 2025
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

OneUptime is a solution for monitoring and managing online services. In version 9.0.5598, a low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface. This issue has been patched in version 9.1.0.

Key dates

02Disclosure timeline

November 26, 2025 CVE published
November 26, 2025 Record updated