CVE-2026-32230

Katalog CVE

CVSS 5.3 · Medium EPSS 0,86%

Kerentanan Missing Authorization pada uptime.kuma uptime kuma. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query before returning data. The ping endpoint skips this check entirely, allowing unauthenticated users to extract average ping/response time data for private monitors. This vulnerability is fixed in 2.2.0.

Rincian

Terbit di NVD

12 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,86% peluang dieksploitasi; lebih tinggi dari 57,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/louislam/uptime-kuma/security/advisories/GHSA-c7hf-c5p5-5g6h exploit · mitigasi · advisory vendor
• https://github.com/louislam/uptime-kuma/commit/303a609c05d0b174a5045c90f53c2b557d4febae patch
• https://github.com/louislam/uptime-kuma/issues/7038 issue tracking
• https://github.com/louislam/uptime-kuma/issues/7135 issue tracking
• https://github.com/louislam/uptime-kuma/releases/tag/2.2.0 release notes