{"cve":"CVE-2023-49804","nvd":{"published":"2023-12-11T23:15:07.840","modified":"2026-06-17T06:36:30.060","status":"Modified","description":"Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. This vulnerability allows unauthorized access to user accounts, compromising the security of sensitive information. The same vulnerability was partially fixed in  CVE-2023-44400, but logging existing users out of their accounts was forgotten. To mitigate the risks associated with this vulnerability, the maintainers made the server emit a `refresh` event (clients handle this by reloading) and then disconnecting all clients except the one initiating the password change. It is recommended to update Uptime Kuma to version 1.23.9.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-384"],"references":["https://github.com/louislam/uptime-kuma/commit/482049c72b3a650c7bc5c26c2f4d57a21c0e0aa0","https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3","https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g","https://github.com/louislam/uptime-kuma/commit/482049c72b3a650c7bc5c26c2f4d57a21c0e0aa0","https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3"],"products":["dockge.kuma:dockge","uptime.kuma:uptime_kuma"],"source":"nvd","synced_at":"2026-10-19T21:42:34.585441961+00:00"},"epss":{"cve":"CVE-2023-49804","score":0.00263,"percentile":0.18242,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-88j4-pcx8-q4q3","url":"https://osv.dev/vulnerability/GHSA-88j4-pcx8-q4q3","summary":"Password Change Vulnerability","modified":"2026-02-04T03:15:59.835725Z","packages":[{"ecosystem":"npm","name":"uptime-kuma","purl":"pkg:npm/uptime-kuma","ranges":["<1.23.9"],"fixed":["1.23.9"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}