CVE-2026-34759CWE-862broken-access-control

CVE-2026-34759

High · published April 2, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
51.6
In the wild
Unconfirmed
What it is

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registered without authentication middleware, while sibling endpoints in the same codebase correctly use ClusterKeyAuthorization.isAuthorizedServiceMiddleware. These endpoints are externally reachable via the Nginx proxy at /notification/. Combined with a projectId leak from the public Status Page API, an unauthenticated attacker can purchase phone numbers on the victim's Twilio account and delete all existing alerting numbers. This issue has been patched in version 10.0.42.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00674 · 51.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-04-02T23:21Z
Affected products (1)
ProductVersionsFixed in
hackerbay/oneuptime< 10.0.4210.0.42
References (3)
https://github.com/OneUptime/oneuptime/commit/9adbd04538714740506708d6fa610e433be4d2a4 · [email protected]https://github.com/OneUptime/oneuptime/releases/tag/10.0.42 · [email protected]https://github.com/OneUptime/oneuptime/security/advisories/GHSA-6wc5-rhvj-cx7f · [email protected]
EPSS history
Timeline
  • 02 APR 18:50Z
    OneUptime: Unauthenticated notification API endpoints - financial abuse via phone number purchase, service disruption, and SMTP credential exposure
    cvelistv5