OneUptime Unauthorized User Creation via API

Vulnerability

Overview

In OneUptime version 9.0.5598, the User table's access control misconfiguration allows any authenticated user, even those with low privileges, to create new accounts by sending a direct API request to the user creation endpoint. The root cause is the assignment of Permission.Public to the create action in the @TableAccessControl decorator, as shown in the fix commit [3]. This bypasses the intended access restrictions that should limit account creation to specific UI paths or administrative roles [1][4].

Exploitation

Details

An attacker with a low-permission account (e.g., a newly created user) can craft a direct HTTP request to the API endpoint responsible for user creation, without needing to interact with the intended UI or follow the required workflow. No additional authentication or authorization checks are enforced because the create permission is set to Public, meaning any authenticated user is implicitly granted the ability to create new accounts [3][4].

Impact

Successful exploitation allows an attacker to create unauthorized accounts within the OneUptime instance. This compromises the integrity of the user base, enabling an attacker to escalate privileges, gain persistent access, or perform further malicious actions within the monitored environment [1][4].

Mitigation

The vulnerability has been patched in OneUptime version 9.1.0 by removing the Permission.Public entry from the create array in the User model's access control, effectively restricting account creation to authorized contexts [3]. Users should upgrade to version 9.1.0 or later to remediate this issue [1][2][3][4].