CVE-2026-119552: falha de média gravidade em louislam uptime-kuma
Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.3epss 0.2%
Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, then modify monitors, API keys, and enable disableAuth.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
louislam · uptime-kumaCVEs relacionadas — louislam uptime-kuma
No mesmo produto, das mais perigosas para as menos.
CVE-2023-36821HIGHUptime Kuma vulnerable to authenticated remote code execution via malicious plugin installationEPSS 2.0%CVE-2024-56331MEDIUMLocal File Inclusion (LFI) via Improper URL Handling in uptime-kuma's `Real-Browser` monitorEPSS 1.8%CVE-2023-36822MEDIUMUptime Kuma authenticated path traversal via plugin repository name may lead to unavailability or data lossEPSS 1.2%CVE-2026-32230MEDIUMUptime Kuma is Missing Authorization Checks on Ping Badge Endpoint, Leaks Ping times of monitors without needing to be on a status pageEPSS 0.9%CVE-2023-49276MEDIUMAttribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kumaEPSS 0.5%CVE-2023-25811MEDIUMPersistent Cross site scripting (XSS) in Uptime KumaEPSS 0.5%