Which versions of Oneuptime are affected by CVE-2026-34759?

OneUptime versions prior to 10.0.42 contain an authentication bypass in notification API endpoints that permits unauthenticated attackers to manipulate integrated Twilio accounts, including…. A patch is available.

How to fix or mitigate CVE-2026-34759?

Within 24 hours: Identify all OneUptime instances and document current versions via application settings or API diagnostics. Within 7 days: Upgrade all affected OneUptime deployments to version 10.0.42 or later, testing notification workflows post-upgrade. Within 30 days: Audit Twilio account activity logs for unauthorized phone number purchases or deletions since OneUptime deployment, and review Status Page API access controls to limit projectId exposure.

Oneuptime CVE-2026-34759

Q: What is the CVSS score of CVE-2026-34759?

CVE-2026-34759 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-18513 CRITICAL

Missing Authorization (CWE-862)

2026-04-02 GitHub_M

Authentication Bypass Nginx Oneuptime

9.2

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:46 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

10.0.42

EUVD ID Assigned

Apr 02, 2026 - 19:01 euvd

EUVD-2026-18513

Analysis Generated

Apr 02, 2026 - 19:01 vuln.today

CVE Published

Apr 02, 2026 - 18:50 nvd

CRITICAL 9.2

DescriptionCVE.org

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, multiple notification API endpoints are registered without authentication middleware, while sibling endpoints in the same codebase correctly use ClusterKeyAuthorization.isAuthorizedServiceMiddleware. These endpoints are externally reachable via the Nginx proxy at /notification/. Combined with a projectId leak from the public Status Page API, an unauthenticated attacker can purchase phone numbers on the victim's Twilio account and delete all existing alerting numbers. This issue has been patched in version 10.0.42.

AnalysisAI

Authentication bypass in OneUptime notification API endpoints allows unauthenticated remote attackers to manipulate Twilio account resources via missing authorization middleware. Affects all versions prior to 10.0.42. Attackers can purchase phone numbers on victim Twilio accounts and delete configured alerting numbers by exploiting unprotected /notification/ endpoints, using leaked projectId values from public Status Page APIs. No public exploit identified at time of analysis, though attack complexity is rated high (CVSS AC:H) and proof-of-concept details are available in the GitHub security advisory.

Technical ContextAI

OneUptime (cpe:2.3:a:oneuptime:oneuptime) is an open-source monitoring platform that uses Twilio for SMS/voice alerting. The vulnerability stems from CWE-862 (Missing Authorization) where notification API endpoints at /notification/* are exposed through Nginx reverse proxy without implementing ClusterKeyAuthorization.isAuthorizedServiceMiddleware, despite this middleware being correctly applied to sibling endpoints in the same codebase. The architecture flaw creates an inconsistent security boundary: while most API routes require cluster-level authentication tokens, the notification subsystem endpoints are reachable without any credential validation. The attack chain requires combining this missing authorization with a separate information disclosure issue-projectId values that should be internal are exposed through the public-facing Status Page API. These projectIds serve as the only required parameter to invoke privileged Twilio operations (purchasing numbers, deleting configurations) through the unprotected endpoints. The Nginx proxy configuration routes external traffic directly to these handlers without enforcing authentication at the gateway level.

RemediationAI

Upgrade immediately to OneUptime version 10.0.42 or later, which implements proper ClusterKeyAuthorization middleware across all notification API endpoints per commit 9adbd04538714740506708d6fa610e433be4d2a4 available at https://github.com/OneUptime/oneuptime/commit/9adbd04538714740506708d6fa610e433be4d2a4. Release details are documented at https://github.com/OneUptime/oneuptime/releases/tag/10.0.42. Organizations unable to immediately upgrade should implement network-level access controls restricting /notification/* endpoints to trusted internal IP ranges via Nginx configuration, though this is only a temporary mitigation as the underlying authorization flaw remains. Additionally, audit Twilio account activity logs for unauthorized phone number purchases or deletions, and review Status Page API configurations to minimize projectId exposure where feasible. No effective workaround exists that maintains full notification functionality without the authentication fix.