Oneuptime CVE-2026-34759

OneUptime versions prior to 10.0.42 with unauthenticated access to /notification/ API endpoints via Nginx proxy. Attacker exploits missing ClusterKeyAuthorization.isAuthorizedServiceMiddleware. Requires projectId leaked from public Status Page API. No user interaction needed. Enables unauthorized Twilio account manipulation.

This vulnerability presents critical real-world risk despite high attack complexity rating (CVSS 4.0 AC:H). The CVSS vector shows network-reachable (AV:N), no privileges required (PR:N), and high impact across confidentiality, integrity, and availability (VC:H/VI:H/VA:H), yielding a 9.2 score. However, AC:H reflects the multi-step attack requiring both endpoint discovery and projectId enumeration from separate API surfaces. No public exploit identified at time of analysis and no CISA KEV listing, indicating exploitation not confirmed in the wild. The technical impact is severe for affected organizations: attackers can incur unexpected Twilio billing charges through phone number purchases and completely disable incident alerting by deleting configured notification numbers-a particularly damaging scenario for monitoring platforms where alert delivery is mission-critical. The attack is network-based and requires no user interaction (UI:N), making it scriptable once the projectId enumeration technique is understood. SSVC assessment indicates high technical impact (monitoring system compromise, financial fraud via API abuse) but exploitation status remains proof-of-concept level. Patch availability since version 10.0.42 (released per GitHub tag) significantly reduces risk for organizations following standard update cycles, though the open-source nature means internet-exposed instances may lag in patching.

An attacker discovers OneUptime instances through internet scanning and accesses the public Status Page API to enumerate valid projectId values for target organizations. Using these leaked identifiers, the attacker crafts HTTP requests directly to the unprotected /notification/ endpoints (bypassing normal authentication flows) to invoke Twilio integration functions. They purchase premium-rate international phone numbers on the victim's Twilio account, generating significant billing charges, then delete all legitimately configured alerting phone numbers to disable incident notifications. This prevents the operations team from receiving alerts during a subsequent attack or system outage, creating a window for further exploitation or extended service disruption while avoiding detection.