{"id":"EUVD-2025-199748","enisaUuid":"aba0d62c-c201-39be-a9b3-bce916be8797","description":"OneUptime is a solution for monitoring and managing online services. In version 9.0.5598, a low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface. This issue has been patched in version 9.1.0.","datePublished":"Nov 26, 2025, 6:10:16 PM","dateUpdated":"Nov 26, 2025, 6:41:53 PM","baseScore":8.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/OneUptime/oneuptime/security/advisories/GHSA-m449-vh5f-574g\n","aliases":"CVE-2025-65966\nGHSA-m449-vh5f-574g\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"17891e2a-a5cb-31a6-b9ea-ae24ba29e3e1","product":{"name":"oneuptime","vendor":{"name":"OneUptime"}},"product_version":"\u003d 9.0.5598"}],"enisaIdVendor":[{"id":"f07a1ce3-d54c-3a26-94c1-0ff38e6f9e89","vendor":{"name":"OneUptime"}}],"enisaIdVulnerability":[{"id":"5a2408d3-907d-37c6-9126-85bc87279c89","vulnerability":{"id":"CVE-2025-65966","description":"OneUptime is a solution for monitoring and managing online services. In version 9.0.5598, a low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface. This issue has been patched in version 9.1.0.","datePublished":"Nov 26, 2025, 6:10:16 PM","dateUpdated":"Nov 26, 2025, 6:41:53 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/OneUptime/oneuptime/security/advisories/GHSA-m449-vh5f-574g\n","enisa_id":"EUVD-2025-199748\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Oct 27, 2026, 7:20:15 AM","vulnerabilityProduct":[{"id":"66d9ff83-e664-36a5-add8-8cd52c1ace82","product":{"name":"oneuptime","vendor":{"name":"OneUptime"}},"product_version":"\u003d 9.0.5598"}],"vulnerabilityVendor":[{"id":"a72d38df-cfd9-3cef-9d24-5b703eec11d4","vendor":{"name":"OneUptime"}}]}},{"id":"f375742f-a8a1-31d6-8ed1-d723aa8a5758","vulnerability":{"id":"GHSA-m449-vh5f-574g","description":"OneUptime Unauthorized User Creation via API","datePublished":"Nov 26, 2025, 7:33:08 PM","dateUpdated":"Dec 1, 2025, 4:02:30 PM","baseScore":0.0,"references":"https://github.com/OneUptime/oneuptime/security/advisories/GHSA-m449-vh5f-574g\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-65966\nhttps://github.com/OneUptime/oneuptime/commit/07bc6d4edde7397ea6b88f889c065ec392052ab4\nhttps://github.com/OneUptime/oneuptime\n","enisa_id":"EUVD-2025-199748\n","aliases":"GHSA-m449-vh5f-574g\nCVE-2025-65966\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:51:54 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}