CVE-2026-32230

Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query before returning data. The ping endpoint skips this check entirely, allowing unauthenticated users to extract average ping/response time data for private monitors. This vulnerability is fixed in 2.2.0.

• CWE-862

• https://github.com/louislam/uptime-kuma/commit/303a609c05d0b174a5045c90f53c2b557d4febaePatch
• https://github.com/louislam/uptime-kuma/issues/7038Issue Tracking
• https://github.com/louislam/uptime-kuma/issues/7135Issue Tracking
• https://github.com/louislam/uptime-kuma/releases/tag/2.2.0Release Notes
• https://github.com/louislam/uptime-kuma/security/advisories/GHSA-c7hf-c5p5-5g6hExploit, Mitigation, Vendor Advisory
• https://github.com/louislam/uptime-kuma/security/advisories/GHSA-c7hf-c5p5-5g6hExploit, Mitigation, Vendor Advisory

Published

Mar 12, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32225Protection mechanism failure in Windows Shell allows an unau…8.8
• CVE-2026-32226Concurrent execution using shared resource with improper syn…5.9
• CVE-2026-32227SQL Injection vulnerability vulnerability in Apache Ranger. …9.8
• CVE-2026-32228UI / API User with asset materialize permission could trigge…7.5
• CVE-2026-32229In JetBrains Hub before 2026.1 possible on sign-in account m…6.8
• CVE-2026-3223Arbitrary file write & potential privilege escalation exploi…7.8
• CVE-2026-32231ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the ge…8.2
• CVE-2026-32232ZeptoClaw is a personal AI assistant. Prior to 0.7.6, there …9.8
• CVE-2026-32234Parse Server is an open source backend that can be deployed …4.7
• CVE-2026-32235Backstage is an open framework for building developer portal…4.7
• CVE-2026-32236Backstage is an open framework for building developer portal…7.5
• CVE-2026-32237Backstage is an open framework for building developer portal…6.5