CVE-2026-34759 Details
Description
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registered without authentication middleware, while sibling endpoints in the same codebase correctly use ClusterKeyAuthorization.isAuthorizedServiceMiddleware. These endpoints are externally reachable via the Nginx proxy at /notification/. Combined with a projectId leak from the public Status Page API, an unauthenticated attacker can purchase phone numbers on the victim's Twilio account and delete all existing alerting numbers. This issue has been patched in version 10.0.42.
A vulnerability exists in OneUptime, an open-source monitoring platform, prior to version 10.0.42. Multiple notification API endpoints are accessible without authentication, while similar endpoints in the codebase properly implement authorization. This vulnerability, combined with a leaked projectId from the public Status Page API, enables an unauthenticated attacker to purchase phone numbers on the victim's Twilio account and delete existing alerting numbers. The issue has been patched in version 10.0.42.
Users can update to OneUptime version 10.0.42 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OneUptime/oneuptime/commit/9adbd04538714740506708d6fa610e433be4d2a4 | [email protected] | Patch |
| https://github.com/OneUptime/oneuptime/releases/tag/10.0.42 | [email protected] | ProductRelease Notes |
| https://github.com/OneUptime/oneuptime/security/advisories/GHSA-6wc5-rhvj-cx7f | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hackerbay oneuptime | < 10.0.42 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 13, 2026 | Initial Analysis | [email protected] |
| Apr 2, 2026 | New CVE Received | [email protected] |