CVE-2026-30959CWE-285CWE-307CWE-639CWE-862broken-access-control

CVE-2026-30959

Medium · published March 10, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint). This affects the UserWhatsAppAPI.ts endpoint and the UserWhatsAppService.ts service.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00367 · 29.4th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-307 · Improper Restriction of Excessive Authentication Attempts; CWE-639 · Authorization Bypass Through User-Controlled Key; CWE-862 · Missing Authorization
Published
2026-03-10T22:18Z
Affected products (1)
ProductVersionsFixed in
hackerbay/oneuptime< 10.0.2110.0.21
References (3)
https://github.com/OneUptime/oneuptime/releases/tag/10.0.21 · [email protected]https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cw6x-mw64-q6pv · [email protected]https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cw6x-mw64-q6pv · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 10 MAR 17:06Z
    OneUptime has WhatsApp Resend Verification Authorization Bypass
    cvelistv5