CVE-2026-32230: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32230 is a missing authorization vulnerability in Uptime Kuma, an open-source self-hosted monitoring tool, that allows unauthenticated users to extract average ping and response time data for private monitors. The flaw affects versions 2.0.0 through 2.1.3 and was disclosed on March 11, 2026, via a GitHub Security Advisory (GHSA-c7hf-c5p5-5g6h). It was reported by researcher kuranikaran and fixed in version 2.2.0. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is a missing authorization check (CWE-862) in the GET /api/badge/:id/ping/:duration? endpoint within server/routers/api-router.js (approximately line 304). All other badge endpoints — /api/badge/:id/status, /api/badge/:id/uptime/:duration?, /api/badge/:id/avg-response/:duration?, /api/badge/:id/cert-exp, and /api/badge/:id/response — correctly query the database with AND public = 1 to verify that a monitor belongs to a public group before returning data. The ping endpoint, however, directly calls UptimeCalculator.getUptimeCalculator(requestedMonitorId) without performing this check, enabling any unauthenticated network user to query ping data for any monitor ID. No authentication, special privileges, or user interaction is required to exploit this flaw (GitHub Advisory, Fix Commit).

Successful exploitation allows unauthenticated attackers to enumerate private monitor IDs and extract average ping/response time data for monitors that are intentionally kept private and not exposed on any public status page. This leaks information about the existence and reachability of internal monitored services, potentially revealing internal infrastructure topology. The impact is limited to confidentiality (low), with no integrity or availability consequences (GitHub Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, consisting of a simple unauthenticated curl command targeting the vulnerable endpoint. No exploit kits or in-the-wild exploitation have been reported. The EPSS score is approximately 0.031%, indicating low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A Nuclei detection template was also added to the ProjectDiscovery nuclei-templates repository, further lowering the bar for automated scanning (GitHub Advisory, Nuclei Templates).

1. Reconnaissance: Identify internet-facing Uptime Kuma instances running versions 2.0.0–2.1.3 using tools like Shodan or Censys, searching for the Uptime Kuma web interface on common ports (e.g., 3001).
2. Monitor ID enumeration: Sequentially probe monitor IDs by sending unauthenticated GET requests to /api/badge/:id/status (e.g., IDs 1, 2, 3…). A response of N/A indicates the monitor exists but is private; this confirms the instance is vulnerable.
3. Extract private ping data: For each discovered monitor ID, send a request to the vulnerable endpoint: curl http://<target>:3001/api/badge/<id>/ping/24. A valid response (e.g., "Avg. Ping (24h): 10ms") confirms the monitor exists and leaks its average response time.
4. Infer internal infrastructure: Correlate the leaked ping times and monitor IDs to infer the existence, reachability, and performance characteristics of internal services being monitored by the target organization (GitHub Advisory).

• Network: Repeated unauthenticated GET requests to /api/badge/<id>/ping/<duration> from external or unexpected IP addresses, especially sequential ID enumeration (e.g., /api/badge/1/ping/24, /api/badge/2/ping/24, etc.).
• Logs: Web server or application access logs showing high volumes of requests to the /api/badge/*/ping/* endpoint without corresponding session tokens or authentication headers, originating from a single or small set of IP addresses.
• Logs: Requests to /api/badge/*/status returning N/A immediately followed by requests to /api/badge/*/ping/* returning valid data from the same source IP, indicating deliberate bypass of the status check (GitHub Advisory).

Upgrade Uptime Kuma to version 2.2.0 or later, which introduces a shared isMonitorPublic() helper function applied consistently across all badge endpoints including the previously vulnerable ping endpoint (Uptime Kuma 2.2.0, Fix Commit). As a temporary workaround for those unable to upgrade immediately, restrict network-level access to the /api/badge/:id/ping/:duration? endpoint to trusted sources only using a reverse proxy or firewall rules (GitHub Advisory).

The vulnerability was responsibly disclosed by researcher kuranikaran via GitHub's private security advisory process in February 2026, with the advisory published on March 11, 2026. The maintainer (louislam) acknowledged and addressed the issue as part of the 2.2.0 milestone. The fix was credited to the reporter in the release notes, and the community response on the release was positive with 48 reactions. A Nuclei detection template was subsequently contributed to the ProjectDiscovery community templates repository, indicating interest from the security scanning community (GitHub Advisory, Uptime Kuma 2.2.0, Nuclei Templates).