Vulnerability Report Review Request #4505

New issue

Open

opened 2026-02-28 04:05:18 -05:00 by deekerman · 3 comments

deekerman commented

2026-02-28 04:05:18 -05:00

Owner

Originally created by @J1vvoo on GitHub (Dec 4, 2025).

Originally assigned to: @louislam on GitHub.

GitHub Advisory URL for @louislam

https://github.com/louislam/uptime-kuma/security/advisories/GHSA-phcc-72j8-hccf

Originally created by @J1vvoo on GitHub (Dec 4, 2025). Originally assigned to: @louislam on GitHub. ### GitHub Advisory URL for @louislam https://github.com/louislam/uptime-kuma/security/advisories/GHSA-phcc-72j8-hccf

deekerman added the

security

label

2026-02-28 04:05:18 -05:00

deekerman commented

2026-02-28 04:05:21 -05:00

Author

Owner

@jaknz commented on GitHub (Dec 7, 2025):

I hope this is in response to: Admins and defenders gird themselves against maximum-severity server vulnerability!

@jaknz commented on GitHub (Dec 7, 2025): I hope this is in response to: [Admins and defenders gird themselves against maximum-severity server vulnerability](https://arstechnica.com/security/2025/12/admins-and-defenders-gird-themselves-against-maximum-severity-server-vulnerability/)!

deekerman commented

2026-02-28 04:05:23 -05:00

Author

Owner

@CommanderStorm commented on GitHub (Dec 7, 2025):

@jaknz We don't use react.

@CommanderStorm commented on GitHub (Dec 7, 2025): @jaknz We don't use react.

deekerman commented

2026-02-28 04:05:23 -05:00

Author

Owner

@J1vvoo commented on GitHub (Dec 7, 2025):

This issue is not related to the vulnerability mentioned in the Ars Technica article.
The content reported here concerns a Broken Access Control issue in which the /setup path is left exposed during the initial installation of Uptime Kuma, allowing an external user to claim the first administrator account.

Leaving this note to avoid any potential confusion.
I would appreciate it if you could review the GHSA-phcc-72j8-hccf report!

@J1vvoo commented on GitHub (Dec 7, 2025): This issue is not related to the vulnerability mentioned in the Ars Technica article. The content reported here concerns a **Broken Access Control** issue in which the /setup path is left exposed during the initial installation of Uptime Kuma, allowing an external user to claim the first administrator account. Leaving this note to avoid any potential confusion. I would appreciate it if you could review the GHSA-phcc-72j8-hccf report!