Critical severity9.1NVD Advisory· Published Apr 2, 2026· Updated Apr 3, 2026

CVE-2026-34758

Description

OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, unauthenticated access to Notification test and Phone Number management endpoints allows SMS/Call/Email/WhatsApp abuse and phone number purchase. This issue has been patched in version 10.0.42.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Hackerbay/Oneuptime2 versions
cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*range: <10.0.40
- (no CPE)range: <10.0.42

Patches

Vulnerability mechanics

References

github.com/OneUptime/oneuptime/commit/9adbd04538714740506708d6fa610e433be4d2a4nvdPatch
github.com/OneUptime/oneuptime/security/advisories/GHSA-q253-6wcm-h8hpnvdExploitMitigationVendor Advisory
github.com/OneUptime/oneuptime/releases/tag/10.0.42nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.591
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000