Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query before returning data. The ping endpoint skips this check entirely, allowing unauthenticated users to extract average ping/response time data for private monitors. This vulnerability is fixed in 2.2.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-32230 Information Disclosure in Uptime Kuma Badge Endpoint Allowing Private Monitor Data Retrieval https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32230
Post summary
The text announces CVE-2026-32230, highlighting an information disclosure flaw in the Uptime Kuma Badge Endpoint that permits retrieval of private monitor data, with no mention of PoC, exploitation, patch, or false‑positive claims.
CVE-2026-32230 Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does… https://www.cve.org/CVERecord?id=CVE-2026-32230
Post summary
The post announces CVE-2026-32230, noting the specific vulnerable endpoint in Uptime Kuma, but provides no evidence of exploitation, PoC, or patch.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | uptime.kuma | uptime_kuma | - | - | - |