CVE Feed

    Dashboard / CVE / CVE-2025-66028

    CVE-2025-66028

    OneUptime is a solution for monitoring and managing online services. Prior to version 8.0.5567, OneUptime is vulnerable to privilege escalation via Login Response Manipulation. During the login process, the server response included a parameter called isMasterAdmin. By intercepting and modifying this parameter value from false to true, it is possible to gain access to the admin dashboard interface. However, an attacker may be unable to view or interact with the data if they still do not have sufficient permissions. This issue has been patched in version 8.0.5567.

    Published:Nov 26, 2025
    Last Modified:Dec 5, 2025
    EPS:Nov 26, 2025
    EPSS Score:0.00055
    CVSS Score:8.2

    Affected Products

    Vendor
    Hackerbay
    Product
    Oneuptime
    Vendor
    Oneuptime
    Product
    Oneuptime

    Exploits

    https://github.com/OneUptime/oneuptime/security/advisories/GHSA-675q-66gf-gqg8

    Common Weakness Enumeration

    CWE-284 Improper Access Control

    Related CVEs

    CVE-2026-80350 (CVSS 7.1) — OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of …
    CVE-2026-35053 (CVSS 9.2) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, the Worker servic…
    CVE-2026-34840 (CVSS 8.1) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, OneUptime's SAML …
    CVE-2026-34759 (CVSS 9.2) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notifica…
    CVE-2026-34758 (CVSS 9.1) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated a…
    CVE-2026-33396 (CVSS 9.9) — OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.35, a low-privileged …
    CVE-2026-33142 (CVSS 8.1) — OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the fix for CVE…
    CVE-2026-33143 (CVSS 8.7) — OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.34, the WhatsApp PO…
    CVE-2026-32598 (CVSS 6.9) — OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow…
    CVE-2026-32308 (CVSS 7.6) — OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the Markdown viewer com…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High