CVE-2025-66028

OneUptime is a solution for monitoring and managing online services. Prior to version 8.0.5567, OneUptime is vulnerable to privilege escalation via Login Response Manipulation. During the login process, the server response included a parameter called isMasterAdmin. By intercepting and modifying this parameter value from false to true, it is possible to gain access to the admin dashboard interface. However, an attacker may be unable to view or interact with the data if they still do not have sufficient permissions. This issue has been patched in version 8.0.5567.

• CWE-284

• https://github.com/OneUptime/oneuptime/commit/3e72b2a9a4f50f98cf1f6cf13fa3e405715bb370Patch
• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-675q-66gf-gqg8Exploit, Vendor Advisory

Published

Nov 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66022FACTION is a PenTesting Report Generation and Collaboration …9.8
• CVE-2025-66023NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging …4.9
• CVE-2025-66024The XWiki blog application allows users of the XWiki platfor…9
• CVE-2025-66025Caido is a web security auditing toolkit. Prior to version 0…4.3
• CVE-2025-66026REDAXO is a PHP-based CMS. Prior to version 5.20.1, a reflec…6.1
• CVE-2025-66027Rallly is an open-source scheduling and collaboration tool. …6.5
• CVE-2025-66029Open OnDemand provides remote web access to supercomputers. …7.6
• CVE-2025-6603A vulnerability was found in coldfunction qCUDA up to db0085…5.3
• CVE-2025-66030Forge (also called `node-forge`) is a native implementation …5.3
• CVE-2025-66031Forge (also called `node-forge`) is a native implementation …7.5
• CVE-2025-66032Claude Code is an agentic coding tool. Prior to 1.0.93, Due …9.8
• CVE-2025-66033Okta Java Management SDK facilitates interactions with the O…5.3