The vulnerability allows unauthenticated access to certain notification API endpoints in the monitoring platform. By exploiting these exempted routes, an attacker can purchase phone numbers associated with the victim’s Twilio account and delete existing alerting numbers, leading to direct financial loss and breakdown of essential monitoring notifications. This loss of notification integrity threatens the availability of monitoring services and can disrupt alerting workflows.

The affected product is the open‑source OneUptime monitoring platform, specifically all releases before version 10.0.42. Any deployment of these earlier releases with an exposed Nginx proxy at the /notification/ path is vulnerable.

The vulnerability carries a CVSS score of 9.2, indicating high severity. No EPSS score is published, and it is not listed in CISA’s KEV catalog. Attackers can reach the vulnerable endpoints from the Internet through the Nginx reverse proxy, so the attack vector is external network. The exploit requires only that the attacker discovers the public subscriber IDs exposed via the Status Page API; once known, authentication is not required to purchase numbers or delete alerts. Because the endpoints lack any form of authorization middleware, the condition for exploitation is trivial for an external adversary.