Critical severity9.1NVD Advisory· Published Apr 2, 2026· Updated Apr 3, 2026

CVE-2026-34758

Description

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated access to Notification test and Phone Number management endpoints allows SMS/Call/Email/WhatsApp abuse and phone number purchase. This issue has been patched in version 10.0.42.

Affected products

Hackerbay/Oneuptime
cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*
Range: <10.0.40

Patches

9adbd0453871

https://github.com/OneUptime/oneuptimevia nvd-ref

commit

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

github.com/OneUptime/oneuptime/commit/9adbd04538714740506708d6fa610e433be4d2a4nvdPatch
github.com/OneUptime/oneuptime/security/advisories/GHSA-q253-6wcm-h8hpnvdExploitMitigationVendor Advisory
github.com/OneUptime/oneuptime/releases/tag/10.0.42nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.591
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000