CVE-2026-35053

🗓️ 02 Apr 2026 18:55:49Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 60 Views🌐 WEB

Unauthenticated execution in OneUptime via ManualAPI before 10.0.42 allows triggering and manipulation.

Reporter	Title	Published	Views	Family All 10
attackerkb	CVE-2026-35053	2 Apr 202618:55	–	attackerkb
Circl	CVE-2026-35053	2 Apr 202621:40	–	circl
CNNVD	OneUptime 访问控制错误漏洞	2 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-35053 OneUptime: Unauthenticated Workflow Execution via ManualAPI	2 Apr 202618:55	–	cvelist
EUVD	EUVD-2026-18542	2 Apr 202618:55	–	euvd
NVD	CVE-2026-35053	2 Apr 202620:16	–	nvd
Positive Technologies	PT-2026-29883	2 Apr 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-35053: Missing Authentication for Critical Function	2 Apr 202600:00	–	rapid7
RedhatCVE	CVE-2026-35053	3 Apr 202623:01	–	redhatcve
Vulnrichment	CVE-2026-35053 OneUptime: Unauthenticated Workflow Execution via ManualAPI	2 Apr 202618:55	–	vulnrichment

NVD

Vulners

Node

hackerbay oneuptimeRange<10.0.42

[
  {
    "vendor": "OneUptime",
    "product": "oneuptime",
    "versions": [
      {
        "version": "< 10.0.42",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/OneUptime/oneuptime/security/advisories/GHSA-6c3w-7xg4-4cf7
github	www.github.com/OneUptime/oneuptime/releases/tag/10.0.42

Parameter	Position	Path	Description	CWE
workflowId	path	/workflow/manual/run/:workflowId	Unauthenticated access to the workflow run endpoint allows triggering executions via the workflowId in the URL.	CWE-306
body	request body	/workflow/manual/run/:workflowId	POST endpoint can be abused with attacker-controlled input data to trigger workflow execution without authentication.	CWE-306

24 Jul 2026 21:10Current

6Medium risk

Vulners AI Score6

CVSS 3.19.8

CVSS 49.2

EPSS0.00823

SSVC

CWE-306