Vulnerability Report Review Request

[J1vvoo]

GitHub Advisory URL for @louislam

https://github.com/louislam/uptime-kuma/security/advisories/GHSA-phcc-72j8-hccf

[jaknz]

I hope this is in response to: Admins and defenders gird themselves against maximum-severity server vulnerability!

[CommanderStorm]

@jaknz We don't use react.

[J1vvoo]

This issue is not related to the vulnerability mentioned in the Ars Technica article.
The content reported here concerns a Broken Access Control issue in which the /setup path is left exposed during the initial installation of Uptime Kuma, allowing an external user to claim the first administrator account.

Leaving this note to avoid any potential confusion.
I would appreciate it if you could review the GHSA-phcc-72j8-hccf report!