OneUptime Authorization and Code Execution Flaws

OneUptime prior to 10.0.21 has a fourth vulnerability in Synthetic monitoring exposing dangerous functionality.

OneUptime prior to 10.0.21 has a third authorization bypass enabling low-privileged users to access admin functions.

Unauthenticated path traversal in OneUptime prior to 10.0.21 lets remote attackers read arbitrary files from the server filesystem through the /workflow/docs/:componentName endpoint. The flaw is remotely exploitable against network-reachable default installations with no credentials or user interaction, and it carries a CVSS 3.1 score of 8.6 with scope change because an unauthenticated web route can read files outside the application's authority. Publicly available exploit code exists, though EPSS is low at 0.05% (15th percentile); vendor-released patch: 10.0.21.