Security: first-run setup can be completed by an unauthenticated party on a not-yet-configured instance #8165

📑 I have found these related issues/pull requests

Related: #7490 (closed) and #7491 (open) both concern /setup-database being reachable after an instance is already configured, where setup does nothing.

This is different: it is about an instance that is not yet configured, where the first-run setup can be completed by someone who is not the operator. I could not find an existing issue covering that case.

🛡️ Security Policy

• I have read and agree to Uptime Kuma's Security Policy.

📝 Description

Type of issue: unauthenticated first-run admin account creation.

On a freshly deployed instance where the admin account has not been created yet, the first-run setup can be completed by an unauthenticated party. Whoever reaches the instance before the operator finishes setup ends up owning it, and the operator is then locked out (their own setup attempt reports the instance as already initialized).

I am deliberately not including reproduction details or payloads here, per the security policy — those are in the private advisory.

👟 Reproduction steps

Reported privately (advisory), not in public, per policy.

👀 Expected behavior

First-run setup should only be completable by the person deploying the instance.

😓 Actual Behavior

First-run setup can be completed by an unauthenticated third party that reaches the instance before the operator does.

🐻 Uptime-Kuma Version

2.5.11

💻 Operating System and Arch

Linux x86_64 (Docker image louislam/uptime-kuma:2)

🌐 Browser

N/A (API / socket.io)

🖥️ Deployment Environment

Docker, SQLite, default configuration, freshly deployed and not yet configured.