Unprotected notification APIs in OneUptime prior to version 10.0.42 allow unauthenticated callers to trigger Twilio phone number purchases and delete existing alerting numbers, resulting in direct financial abuse. When combined with an exposed project identifier from the public status page API, attackers can reset notification settings and remove service endpoints, causing widespread service disruptions. The vulnerability is classified as a missing authorization flaw.

The product affected is the OneUptime monitoring and observability platform, with vendor OneUptime. All releases earlier than 10.0.42 contain the flaw; the issue was resolved in release 10.0.42.

The CVSS score of 9.2 reflects a high severity level, while the EPSS score of less than 1 percent indicates a low probability of widespread exploitation under current conditions. The vulnerability is not listed in the CISA KEV catalog. An attacker could exploit the flaw by sending unauthenticated HTTP requests to the /notification/ endpoints exposed through the Nginx proxy, using a publicly available project identifier to target specific instances.