CVE-2023-49804 json
Uptime Kuma Password Change Vulnerability
published 2023-12-11 2 y ago modified 2026-06-17 4 mo ago also GHSA-88j4-pcx8-q4q3 , EUVD-2023-3159
- cvss
- 6.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 18%
- public exploits
- 0
- none known
Summary
Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. This vulnerability allows unauthorized access to user accounts, compromising the security of sensitive information. The same vulnerability was partially fixed in CVE-2023-44400, but logging existing users out of their accounts was forgotten. To mitigate the risks associated with this vulnerability, the maintainers made the server emit a `refresh` event (clients handle this by reloading) and then disconnecting all clients except the one initiating the password change. It is recommended to update Uptime Kuma to version 1.23.9.
Patch / fix
- npm uptime-kuma 1.23.9
- dockge.kuma dockge 1.3.3
- uptime.kuma uptime_kuma 1.23.9
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | uptime-kuma | <1.23.9 |
1.23.9 |
Affected products
- louislam uptime-kuma
Classification
- Weakness
-
- CWE-384 Session Fixation
References
-
github.com
/louislam/uptime-kuma/commit/482049c72b3a650c7bc5c26c2f4d57a21c0e0aa0
web, patch
-
github.com
/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3
web, vendor-advisory
-
github.com
/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g
web, not-applicable
-
nvd.nist.gov
/vuln/detail/CVE-2023-49804
advisory
-
github.com
/louislam/uptime-kuma
package
Sources
- CVE List CVE-2023-49804
- GitHub Advisory GHSA-88j4-pcx8-q4q3
- NVD CVE-2023-49804
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.