| Package | Affected versions | Patched versions |
|---|---|---|
| oneuptime | = 9.0.5598 | |
| @oneuptime/common | < 9.1.0 | 9.1.0 |
A low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface.
A low-permission user sends a crafted API request to the user-creation endpoint and the system creates the account successfully.
This allows attackers to create unauthorized accounts.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free