What is the CVSS score of CVE-2026-30959?

CVE-2026-30959 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Oneuptime are affected by CVE-2026-30959?

Organizations using OneUptime should be aware of moderate risk from CVE-2026-30959 rated CVSS 5.0. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for CVE-2026-30959?

Yes, a public proof-of-concept exploit is available for CVE-2026-30959. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-30959?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Oneuptime CVE-2026-30959

MEDIUM

Improper Authorization (CWE-285)

2026-03-10 security-advisories@github.com

GHSA-cw6x-mw64-q6pv

Oneuptime

5.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.0 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 12, 2026 - 14:01 vuln.today

Public exploit code

CVE Published

Mar 10, 2026 - 18:18 nvd

MEDIUM 5.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 npm packages depend on @oneuptime/common (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 10.0.21.

DescriptionGitHub Advisory

OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint). This affects the UserWhatsAppAPI.ts endpoint and the UserWhatsAppService.ts service.

AnalysisAI

OneUptime's resend-verification-code endpoint fails to validate user ownership of WhatsApp records, allowing any authenticated attacker to trigger verification code resends for arbitrary users. Public exploit code exists for this vulnerability, which could enable account enumeration or facilitate phishing attacks against other users. The vulnerability affects the UserWhatsAppAPI and UserWhatsAppService components with no patch currently available.

Technical ContextAI

Classified as CWE-285 (Improper Authorization). Affects Oneuptime. OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint). This affects the UserWhatsAppAPI.ts endpoint and the UserWhatsAppService.ts service.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in Oneuptime

View all

CVE-2026-27728 CRITICAL Act Now POC

9.9 Feb 25

OS command injection in OneUptime monitoring platform before 10.0.7. Authenticated users can execute arbitrary commands

CVE-2026-30957 CRITICAL Act Now POC

9.9 Mar 10

OneUptime prior to 10.0.21 has a fourth vulnerability in Synthetic monitoring exposing dangerous functionality.

CVE-2026-27574 CRITICAL Act Now POC

9.9 Feb 21

Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.

CVE-2026-30887 CRITICAL Act Now POC

9.9 Mar 10

OneUptime monitoring platform prior to 10.0.18 allows code injection (CVSS 9.9) enabling RCE through the monitoring conf

CVE-2026-30956 CRITICAL Act Now POC

9.9 Mar 10

OneUptime prior to 10.0.21 has a third authorization bypass enabling low-privileged users to access admin functions.

CVE-2026-30921 CRITICAL Act Now POC

9.9 Mar 10

OneUptime prior to 10.0.20 exposes dangerous functionality in Synthetic monitoring that enables code execution.

CVE-2025-65966 HIGH This Week POC

8.8 Nov 26

OneUptime is a solution for monitoring and managing online services. Rated high severity (CVSS 8.8), this vulnerability

CVE-2026-30920 HIGH This Week POC

8.6 Mar 10

OneUptime versions prior to 10.0.19 allow unauthenticated attackers to hijack GitHub App integrations across projects by

CVE-2024-29194 HIGH This Week POC

8.3 Mar 24

OneUptime is a solution for monitoring and managing online services. Rated high severity (CVSS 8.3), this vulnerability

CVE-2026-28787 HIGH This Week POC

8.2 Mar 06

OneUptime versions 10.0.11 and earlier contain an improper WebAuthn implementation where server-side challenge validatio

CVE-2026-30958 HIGH This Week POC

7.2 Mar 10

Unauthenticated path traversal in OneUptime versions before 10.0.21 allows remote attackers to read arbitrary files from

CVE-2025-66028 MEDIUM This Month POC

6.9 Nov 26

OneUptime is a solution for monitoring and managing online services. Rated medium severity (CVSS 6.9), this vulnerabilit

Same weakness CWE-285 – Improper Authorization

View all

CVE-2025-29927 CRITICAL POC

9.1

CVE-2016-5676 HIGH POC

7.5

CVE-2025-66301 CRITICAL POC

9.6

CVE-2023-32707 HIGH POC

8.8

CVE-2016-3352 HIGH

8.8

CVE-2025-29659 CRITICAL POC

9.8

CVE-2022-2595 CRITICAL POC

10.0

CVE-2026-30956 CRITICAL POC

9.9

CVE-2026-30959 vulnerability details – vuln.today

Back

Oneuptime CVE-2026-30959

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

Blast Radius

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Oneuptime

Same weakness CWE-285 – Improper Authorization

Share

External POC / Exploit Code