Vulnerability-Lookup

CVE-2026-30959 (GCVE-0-2026-30959)

Vulnerability from cvelistv5 – Published: 2026-03-10 17:06 – Updated: 2026-03-10 17:59

Title

OneUptime has WhatsApp Resend Verification Authorization Bypass

Summary

OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint). This affects the UserWhatsAppAPI.ts endpoint and the UserWhatsAppService.ts service.

Severity ?

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

CWE

CWE-285 - Improper Authorization
CWE-307 - Improper Restriction of Excessive Authentication Attempts
CWE-639 - Authorization Bypass Through User-Controlled Key
CWE-862 - Missing Authorization

Assigner

GitHub_M

References

URL

Tags

	https://github.com/OneUptime/oneuptime/security/a…	x_refsource_CONFIRM
	https://github.com/OneUptime/oneuptime/releases/t…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	OneUptime	oneuptime	Affected: < 10.0.21

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-30959",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-10T17:59:00.763622Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-10T17:59:05.359Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cw6x-mw64-q6pv"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "oneuptime",
          "vendor": "OneUptime",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 10.0.21"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint). This affects the UserWhatsAppAPI.ts endpoint and the UserWhatsAppService.ts service."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-307",
              "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-10T17:06:33.581Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cw6x-mw64-q6pv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cw6x-mw64-q6pv"
        },
        {
          "name": "https://github.com/OneUptime/oneuptime/releases/tag/10.0.21",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OneUptime/oneuptime/releases/tag/10.0.21"
        }
      ],
      "source": {
        "advisory": "GHSA-cw6x-mw64-q6pv",
        "discovery": "UNKNOWN"
      },
      "title": "OneUptime has WhatsApp Resend Verification Authorization Bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-30959",
    "datePublished": "2026-03-10T17:06:33.581Z",
    "dateReserved": "2026-03-07T17:34:39.981Z",
    "dateUpdated": "2026-03-10T17:59:05.359Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-30959\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-10T18:18:55.047\",\"lastModified\":\"2026-03-12T14:01:15.397\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint). This affects the UserWhatsAppAPI.ts endpoint and the UserWhatsAppService.ts service.\"},{\"lang\":\"es\",\"value\":\"OneUptime es una soluci\u00f3n para monitorear y gestionar servicios en l\u00ednea. El endpoint resend-verification-code permite a cualquier usuario autenticado activar un reenv\u00edo de c\u00f3digo de verificaci\u00f3n para cualquier registro de UserWhatsApp por ID. La propiedad no se valida (a diferencia del endpoint verify). Esto afecta al endpoint UserWhatsAppAPI.ts y al servicio UserWhatsAppService.ts.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L\",\"baseScore\":5.0,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.1,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-285\"},{\"lang\":\"en\",\"value\":\"CWE-307\"},{\"lang\":\"en\",\"value\":\"CWE-639\"},{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"10.0.21\",\"matchCriteriaId\":\"ED54DE0A-2CD8-4372-BECA-6F3AF29F2C2B\"}]}]}],\"references\":[{\"url\":\"https://github.com/OneUptime/oneuptime/releases/tag/10.0.21\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\",\"Release Notes\"]},{\"url\":\"https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cw6x-mw64-q6pv\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cw6x-mw64-q6pv\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-30959\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-10T17:59:00.763622Z\"}}}], \"references\": [{\"url\": \"https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cw6x-mw64-q6pv\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-10T17:58:47.119Z\"}}], \"cna\": {\"title\": \"OneUptime has WhatsApp Resend Verification Authorization Bypass\", \"source\": {\"advisory\": \"GHSA-cw6x-mw64-q6pv\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"LOW\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"OneUptime\", \"product\": \"oneuptime\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 10.0.21\"}]}], \"references\": [{\"url\": \"https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cw6x-mw64-q6pv\", \"name\": \"https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cw6x-mw64-q6pv\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/OneUptime/oneuptime/releases/tag/10.0.21\", \"name\": \"https://github.com/OneUptime/oneuptime/releases/tag/10.0.21\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint). This affects the UserWhatsAppAPI.ts endpoint and the UserWhatsAppService.ts service.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-285\", \"description\": \"CWE-285: Improper Authorization\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-307\", \"description\": \"CWE-307: Improper Restriction of Excessive Authentication Attempts\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-639\", \"description\": \"CWE-639: Authorization Bypass Through User-Controlled Key\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862: Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-10T17:06:33.581Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-30959\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-10T17:59:05.359Z\", \"dateReserved\": \"2026-03-07T17:34:39.981Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-10T17:06:33.581Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-30959

Vulnerability from fkie_nvd - Published: 2026-03-10 18:18 - Updated: 2026-03-12 14:01

Severity ?

5.0 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/OneUptime/oneuptime/releases/tag/10.0.21	Product, Release Notes
security-advisories@github.com	https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cw6x-mw64-q6pv	Exploit, Mitigation, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cw6x-mw64-q6pv	Exploit, Mitigation, Vendor Advisory

Impacted products

	Vendor	Product	Version
	hackerbay	oneuptime	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED54DE0A-2CD8-4372-BECA-6F3AF29F2C2B",
              "versionEndExcluding": "10.0.21",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint). This affects the UserWhatsAppAPI.ts endpoint and the UserWhatsAppService.ts service."
    },
    {
      "lang": "es",
      "value": "OneUptime es una soluci\u00f3n para monitorear y gestionar servicios en l\u00ednea. El endpoint resend-verification-code permite a cualquier usuario autenticado activar un reenv\u00edo de c\u00f3digo de verificaci\u00f3n para cualquier registro de UserWhatsApp por ID. La propiedad no se valida (a diferencia del endpoint verify). Esto afecta al endpoint UserWhatsAppAPI.ts y al servicio UserWhatsAppService.ts."
    }
  ],
  "id": "CVE-2026-30959",
  "lastModified": "2026-03-12T14:01:15.397",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-10T18:18:55.047",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/OneUptime/oneuptime/releases/tag/10.0.21"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cw6x-mw64-q6pv"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cw6x-mw64-q6pv"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        },
        {
          "lang": "en",
          "value": "CWE-307"
        },
        {
          "lang": "en",
          "value": "CWE-639"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-CW6X-MW64-Q6PV

Vulnerability from github – Published: 2026-03-10 01:15 – Updated: 2026-03-10 18:45

Summary

OneUptime has WhatsApp Resend Verification Authorization Bypass

Details

Description

The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint).

Affected Source

Endpoint: UserWhatsAppAPI.ts
Service: UserWhatsAppService.ts
Verify ownership (present in verify endpoint for comparison): UserWhatsAppAPI.ts

Full Code Lines (UserWhatsAppAPI.ts)

Resend path (authorization gap):

    this.router.post(
      `${new this.entityType()
        .getCrudApiPath()
        ?.toString()}/resend-verification-code`,
      UserMiddleware.getUserMiddleware,
      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
        try {
          req = req as OneUptimeRequest;

          if (!req.body.itemId) {
            return Response.sendErrorResponse(
              req,
              res,
              new BadDataException("Invalid item ID"),
            );
          }

          await this.service.resendVerificationCode(req.body.itemId);

          return Response.sendEmptySuccessResponse(req, res);
        } catch (err) {
          return next(err);
        }
      },
    );

Verify path (ownership check present):

          if (
            item.userId?.toString() !==
            (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()
          ) {
            return Response.sendErrorResponse(
              req,
              res,
              new BadDataException("Invalid user ID"),
            );
          }

Prerequisites

Valid attacker account with access to a project
Attacker access token
A victim’s UserWhatsApp itemId belonging to the same project

Steps to Reproduce

Set your attacker token:

bash export ATK="Bearer <attacker-access-token>"

Trigger resend for the victim’s item:

bash curl -s -X POST \ -H "Content-Type: application/json" \ -H "Authorization: $ATK" \ -d '{"itemId":"<victim-userwhatsapp-id>"}' \ http://<host>/api/user-whats-app/resend-verification-code

Expected/Observed Behavior

HTTP 200 with {} body and a new verification code sent to the victim’s phone
No checks confirm that item.userId equals the authenticated user’s ID for the resend path

Impact

Spam/DoS against victims’ phone numbers, social engineering pressure, and potential lockout flows due to repeated resends

Recommended Fix

Enforce ownership: item.userId must match the authenticated user
Add per-item and per-user rate limiting for resends

Severity ?

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@oneuptime/common"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "10.0.21"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-30959"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-307",
      "CWE-639",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-10T01:15:30Z",
    "nvd_published_at": "2026-03-10T18:18:55Z",
    "severity": "MODERATE"
  },
  "details": "### Description  \n  The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any `UserWhatsApp` record by ID. Ownership is not validated (unlike the verify endpoint).\n\n### Affected Source  \n- Endpoint: [UserWhatsAppAPI.ts](https://github.com/OneUptime/oneuptime/Common/Server/API/UserWhatsAppAPI.ts#L129-L153)  \n- Service: [UserWhatsAppService.ts](https://github.com/OneUptime/oneuptime/Common/Server/API/UserWhatsAppAPI.ts#L129-L153)  \n- Verify ownership (present in verify endpoint for comparison): [UserWhatsAppAPI.ts](https://github.com/OneUptime/oneuptime/Common/Server/API/UserWhatsAppAPI.ts#L78-L87)\n\n\n### Full Code Lines (UserWhatsAppAPI.ts)\n\nResend path (authorization gap):\n\n```ts\n    this.router.post(\n      `${new this.entityType()\n        .getCrudApiPath()\n        ?.toString()}/resend-verification-code`,\n      UserMiddleware.getUserMiddleware,\n      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) =\u003e {\n        try {\n          req = req as OneUptimeRequest;\n\n          if (!req.body.itemId) {\n            return Response.sendErrorResponse(\n              req,\n              res,\n              new BadDataException(\"Invalid item ID\"),\n            );\n          }\n\n          await this.service.resendVerificationCode(req.body.itemId);\n\n          return Response.sendEmptySuccessResponse(req, res);\n        } catch (err) {\n          return next(err);\n        }\n      },\n    );\n```\n\nVerify path (ownership check present):\n\n```ts\n          if (\n            item.userId?.toString() !==\n            (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()\n          ) {\n            return Response.sendErrorResponse(\n              req,\n              res,\n              new BadDataException(\"Invalid user ID\"),\n            );\n          }\n```\n\n## Prerequisites\n- Valid attacker account with access to a project\n- Attacker access token\n- A victim\u2019s `UserWhatsApp` itemId belonging to the same project\n\n## Steps to Reproduce\n1. Set your attacker token:\n\n   ```bash\n   export ATK=\"Bearer \u003cattacker-access-token\u003e\"\n   ```\n\n2. Trigger resend for the victim\u2019s item:\n\n   ```bash\n   curl -s -X POST \\\n     -H \"Content-Type: application/json\" \\\n     -H \"Authorization: $ATK\" \\\n     -d \u0027{\"itemId\":\"\u003cvictim-userwhatsapp-id\u003e\"}\u0027 \\\n     http://\u003chost\u003e/api/user-whats-app/resend-verification-code\n   ```\n\n## Expected/Observed Behavior\n- HTTP 200 with `{}` body and a new verification code sent to the victim\u2019s phone\n- No checks confirm that `item.userId` equals the authenticated user\u2019s ID for the resend path\n\n## Impact\n- Spam/DoS against victims\u2019 phone numbers, social engineering pressure, and potential lockout flows due to repeated resends\n\n## Recommended Fix\n- Enforce ownership: `item.userId` must match the authenticated user\n- Add per-item and per-user rate limiting for resends",
  "id": "GHSA-cw6x-mw64-q6pv",
  "modified": "2026-03-10T18:45:24Z",
  "published": "2026-03-10T01:15:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cw6x-mw64-q6pv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30959"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OneUptime/oneuptime"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OneUptime/oneuptime/releases/tag/10.0.21"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OneUptime has WhatsApp Resend Verification Authorization Bypass"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-30959 (GCVE-0-2026-30959)

FKIE_CVE-2026-30959

GHSA-CW6X-MW64-Q6PV

Description

Affected Source

Full Code Lines (UserWhatsAppAPI.ts)

Prerequisites

Steps to Reproduce

Expected/Observed Behavior

Impact

Recommended Fix

Tags

Sightings

Nomenclature