PT-2026-29876 · Twilio+1 · Twilio+1

Kodareef5 · Published 2026-04-02 · Updated 2026-04-03 · CVE-2026-34759

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OneUptime versions prior to 10.0.42

Description OneUptime, an open-source monitoring and observability platform, had multiple notification API endpoints registered without authentication middleware. This allowed an unauthenticated attacker to potentially purchase phone numbers on a victim's Twilio account and delete existing alerting numbers. The issue stemmed from a missing authentication check in the /notification/ endpoints, while other endpoints correctly used authentication. A projectId leak from the public Status Page API contributed to the exploitability.

Recommendations Update to version 10.0.42 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-34759

Affected Products

Oneuptime

Twilio

References · 6

• https://github.com/OneUptime/oneuptime/commit/9adbd04538714740506708d6fa610e433be4d2a4 · Patch
• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-6wc5-rhvj-cx7f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34759 · Security Note
• https://github.com/OneUptime/oneuptime/releases/tag/10.0.42 · Note
• https://twitter.com/CVEnew/status/2040128780111339668 · Twitter Post
• https://twitter.com/0dayPublishing/status/2040057863746285983 · Twitter Post