CVE-2026-32230
Uptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status page
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query before returning data. The ping endpoint skips this check entirely, allowing unauthenticated users to extract average ping/response time data for private monitors. This vulnerability is fixed in 2.2.0.
| CWE | CWE-862 |
| Vendor | louislam |
| Product | uptime-kuma |
| Published | Mar 12, 2026 |
| Last Updated | Mar 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for louislam uptime-kuma
Be the first to know when new medium vulnerabilities affecting louislam uptime-kuma are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
louislam / uptime-kuma
>= 2.0.0, < 2.2.0
References
github.com: https://github.com/louislam/uptime-kuma/security/advisories/GHSA-c7hf-c5p5-5g6h github.com: https://github.com/louislam/uptime-kuma/issues/7038 github.com: https://github.com/louislam/uptime-kuma/issues/7135 github.com: https://github.com/louislam/uptime-kuma/commit/303a609c05d0b174a5045c90f53c2b557d4febae github.com: https://github.com/louislam/uptime-kuma/releases/tag/2.2.0