Uptime.Kuma Uptime Kuma vulnerabilities

CVE-2026-32230 [MEDIUM] CWE-862 CVE-2026-32230: Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query before returning data. The ping endpoint skips this c

CVE-2023-49805 [HIGH] CWE-1385 CVE-2023-49805: Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket (with Socket.io), but it does not verify that the source of communication is valid. This allows third-party website to access the application on behalf of their client. When connecting to the server using Socket.IO, the server does not va

CVE-2023-44400 [HIGH] CWE-384 CVE-2023-44400: Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a us Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity periods. Version 1.23.3 has a patch for the issue.

CVE-2023-49804 [HIGH] CVE-2023-49804: Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user chan Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. This vulnerability allows unauthorized access to user accounts, co

CVE-2026-33130 [MEDIUM] CWE-98 CVE-2026-33130: Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fi Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9pq-4crh doesn't fully work to preventServer-side Template Injection (SSTI). The three mitigations added to the Liquid engine (root, relativeReference, dynamicPartials) only block quoted paths. If a project uses an unquoted absolute p

CVE-2023-49276 [MEDIUM] CWE-79 CVE-2023-49276: Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting (XSS). Since the custom status interface can set an independent Google Analytics ID and the template has not been sanitized, there is an attribute injection vulnerability her