MEDIUM🇵🇱 Wersja polska

CVE-2026-32230

CVSS 5.3v3.1pub. 2026-03-12upd. 2026-03-19

Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query before returning data. The ping endpoint skips this check entirely, allowing unauthenticated users to extract average ping/response time data for private monitors. This vulnerability is fixed in 2.2.0.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

  • Uptime.kuma Uptime Kuma

    APP
    Uptime.Kuma
    2.0.0 – 2.2.0 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLi
CWE
References

Related vulnerabilities

CVE-2026-33130MEDIUM6.5ten sam produkt

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHS...

CVE-2023-49804MEDIUM6.7ten sam produkt

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their ...

CVE-2023-49805MEDIUM6.0ten sam produkt

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSo...

CVE-2023-49276MEDIUM6.3ten sam produkt

Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element i...

CVE-2023-44400MEDIUM6.7ten sam produkt

Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's devic...