CVE-2026-32230 — exposed on the internet

CVE-2026-32230: CWE-862: Missing Authorization in louislam uptime-kuma

Internet exposure observed by OffSeq scans · last 30 days

Found on 1 internet-exposed hosts by OffSeq scans; no in-the-wild exploitation has been observed against OffSeq honeypots in this window.

About CVE-2026-32230

CVE-2026-32230 is a medium severity vulnerability in Uptime Kuma versions 2.0.0 through 2.1.3 where the GET /api/badge/:id/ping/:duration? endpoint fails to verify authorization properly. This flaw allows unauthenticated users to access average ping/response time data for private monitors, bypassing the intended access control that restricts such data to public monitors only. The vulnerability arises from missing authorization checks on this specific endpoint, while other badge endpoints correctly enforce public group verification. Exploitation requires no authentication or user interaction and can lead to unauthorized disclosure of monitoring data. The issue is fixed in version 2.

Vendor: louislamCWE-862

OffSeq internet scanning found CVE-2026-32230 on 1 exposed hosts in the last 30 days. OffSeq honeypots have not recorded in-the-wild exploitation of this CVE in the current window — this page tracks its exposure footprint and status; if exploitation begins, the live honeypot signal will appear here.

References