CVE-2026-34759

Endpoints in the /notification/ path are accessible externally through Nginx proxy without requiring any authentication. An attacker can obtain the projectId value through the public Status Page API, which does not require login. With this identifier, they can send unauthorized requests to notification endpoints — including purchasing new phone numbers charged to the victim's Twilio account and deleting all existing alarm numbers.

An unauthenticated attacker can generate financial costs on the platform owner's Twilio account by purchasing phone numbers, as well as deprive the organization of all configured alarm notifications, which may lead to loss of monitoring continuity and incident response.

OneUptime should be updated to version 10.0.42 or later, in which the issue has been fixed by adding appropriate authentication middleware to the affected notification API endpoints. The patch is available in the project's GitHub repository (commit 9adbd04538714740506708d6fa610e433be4d2a4) and in the release tagged 10.0.42.

OneUptime (Hackerbay) in versions before 10.0.42