The Worker service in OneUptime exposes workflow execution endpoints that require no authentication. An attacker who discovers or guesses a workflow ID can trigger arbitrary workflow execution with custom input, leading to JavaScript code execution, notification abuse, and data manipulation. This represents a high‑severity flaw in the form of missing authentication controls (CWE-306), allowing a remote attacker to compromise confidentiality, integrity, and availability of the system.

The affected product is the OneUptime monitoring and observability platform, specifically its Worker service ManualAPI. Versions prior to 10.0.42 are vulnerable; the issue was fixed in the 10.0.42 release. Vulnerability involves the /workflow/manual/run/:workflowId GET and POST endpoints which allow unauthenticated workflow execution.

The vulnerability carries a CVSS score of 9.2, indicating critical impact, while the EPSS score is below 1%, suggesting a low probability of exploitation so far. It is not listed in the CISA KEV catalog. Based on the description, the attack vector is remote and unauthenticated; an attacker needs to obtain or guess a valid workflow ID to exploit the flaw, but no additional privileged access is required.