CVE-2026-34758
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
OneUptime prior to version 10.0.42 allows unauthenticated access to Notification test and Phone Number management endpoints, enabling SMS/Call/Email/WhatsApp abuse and phone number purchase.
Risk Assessment
An attacker can exploit these endpoints to send unwanted messages or make calls, potentially leading to financial and reputational costs.
Recommendation
Update OneUptime to version 10.0.42 or later, which includes a fix for the unauthenticated access to these endpoints.
Original NVD description (English source)
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated access to Notification test and Phone Number management endpoints allows SMS/Call/Email/WhatsApp abuse and phone number purchase. This issue has been patched in version 10.0.42.