Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.7
CVE-2023-49804: Uptime Kuma password change keeps old sessions active
CVE-2023-49804 · published 2 years ago
Summary
When a user changes their password in Uptime Kuma (versions before 1.23.9), any other users who were already logged in stay logged in and can still use the account. This can let unauthorized people continue to see sensitive data even after a password change. Upgrade to version 1.23.9 or later to ensure all sessions are logged out when the password is changed.
What to do
- Update louislam uptime-kuma to version 1.23.9.
- Update dockge.kuma dockge to version 1.3.3 or later.
- Update uptime.kuma uptime_kuma to version 1.23.9 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | louislam | uptime-kuma |
< 1.23.9 Fix: upgrade to 1.23.9
|
| – | dockge.kuma | dockge |
< 1.3.3 cpe:2.3:a:dockge.kuma:dockge:*:*:*:*:*:*:*:* |
| – | uptime.kuma | uptime_kuma |
< 1.23.9 cpe:2.3:a:uptime.kuma:uptime_kuma:*:*:*:*:*:*:*:* |
Original advisory text
Uptime Kuma Password Change Vulnerability
Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. This vulnerability allows unauthorized access to user accounts, compromising the security of sensitive information. The same vulnerability was partially fixed in CVE-2023-44400, but logging existing users out of their accounts was forgotten. To mitigate the risks associated with this vulnerability, the maintainers made the server emit a `refresh` event (clients handle this by reloading) and then disconnecting all clients except the one initiating the password change. It is recommended to update Uptime Kuma to version 1.23.9.
References
- https://github.com/advisories/GHSA-88j4-pcx8-q4q3
- https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49804... Vendor Advisory
- https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-49804 Vendor Advisory
- https://github.com/louislam/uptime-kuma/commit/482049c72b3a650c7bc5c26c2f4d57a21... Patch
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-384Session Fixation
Timeline
Published11 Dec 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta