Skip to content
OpenAdvisories
Critical · 9.1 CVE-2026-34758 EUVD-2026-18511

OneUptime: Missing Authentication on Notification Endpoints

Published Apr 2, 2026 · Updated Apr 3, 2026 · Assigned by GitHub_M

Description

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated access to Notification test and Phone Number management endpoints allows SMS/Call/Email/WhatsApp abuse and phone number purchase. This issue has been patched in version 10.0.42.

Affected products

VendorProductAffectedFixed
OneUptime oneuptime < 10.0.42 —

References