Unauthorized Data Access in Uptime Kuma Monitoring Tool by Louis Lam

CVE-2026-32230

What is CVE-2026-32230?

Uptime Kuma, an open-source self-hosted monitoring tool, has a flaw in its API that allows unauthorized access to private monitor information. Specifically, from versions 2.0.0 to 2.1.3, the GET /api/badge/:id/ping/:duration? endpoint does not enforce checks to ensure that the requested monitor belongs to a public group, unlike other badge endpoints that validate access permissions. This oversight allows unauthenticated users to retrieve average ping and response times for private monitors, potentially exposing sensitive data. The vulnerability was addressed in version 2.2.0.

References