Uptime-Kuma < v1.23.0 - Improper Access Control

mediumseverity

5.3CVSS score

1%likelihood of exploitation, next 30 days

63%of all CVEs are less likely

Readycheck to confirm it

Uptime-Kuma before v1.23.0 is vulnerable to an information disclosure issue due to missing authorization on the /api/badge/1/ping/24 endpoint. An unauthenticated attacker can access this endpoint to leak ping statistics, such as average ping and ping history, for existing monitors without needing access to the protected status page. This can lead to unintended exposure of internal monitoring data.

Impact

Information disclosure of monitor ping data to unauthenticated attackers, potentially aiding reconnaissance efforts.

Fix

Upgrade to Uptime-Kuma version 1.23.0 or later, which patches the vulnerable endpoint by introducing proper authorization checks.

How to confirm it

Send: GET {{BaseURL}}/api/badge/1/ping/24
Positive when: status_code == 200 and contains(body, 'Avg. Ping (')

Run it with nuclei: nuclei -id CVE-2026-32230 -u <target>

The full check

id: CVE-2026-32230

info:
  name: Uptime-Kuma < v1.23.0 - Improper Access Control
  author: ritikchaddha
  severity: medium
  description: |
    Uptime-Kuma before v1.23.0 is vulnerable to an information disclosure issue due to missing authorization on the /api/badge/1/ping/24 endpoint. An unauthenticated attacker can access this endpoint to leak ping statistics, such as average ping and ping history, for existing monitors without needing access to the protected status page. This can lead to unintended exposure of internal monitoring data.
  impact: |
    Information disclosure of monitor ping data to unauthenticated attackers, potentially aiding reconnaissance efforts.
  remediation: |
    Upgrade to Uptime-Kuma version 1.23.0 or later, which patches the vulnerable endpoint by introducing proper authorization checks.
  reference:
    - https://github.com/advisories/GHSA-c7hf-c5p5-5g6h
    - https://nvd.nist.gov/vuln/detail/CVE-2026-32230
  classification:
    cve-id: CVE-2026-32230
    epss-score: 0.00981
    epss-percentile: 0.62531
    cwe-id: CWE-862
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cpe: cpe:2.3:a:louislam:uptime-kuma:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: louislam
    product: uptime-kuma
    shodan-query: title:"uptime-kuma"
  tags: cve,cve2026,uptime-kuma,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/badge/1/ping/24"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, 'Avg. Ping (')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from