{"id":"EUVD-2026-10703","enisaUuid":"9b4bf3a8-1944-377a-901c-a016fee0c8dd","description":"OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint). This affects the UserWhatsAppAPI.ts endpoint and the UserWhatsAppService.ts service.","datePublished":"Mar 10, 2026, 5:06:33 PM","dateUpdated":"Mar 10, 2026, 5:59:05 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","references":"https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cw6x-mw64-q6pv\nhttps://github.com/OneUptime/oneuptime/releases/tag/10.0.21\n","aliases":"CVE-2026-30959\nGHSA-cw6x-mw64-q6pv\n","assigner":"GitHub_M","epss":0.39,"enisaIdProduct":[{"id":"4fab6177-9f8e-37f0-bf97-6447f3227ff4","product":{"name":"oneuptime","vendor":{"name":"OneUptime"}},"product_version":"\u003c 10.0.21"}],"enisaIdVendor":[{"id":"1f5d4878-1366-3ad1-9a8c-ceaa36d0730c","vendor":{"name":"OneUptime"}}],"enisaIdVulnerability":[{"id":"165c898c-75f8-3cf8-9d1f-7c17b734e967","vulnerability":{"id":"GHSA-cw6x-mw64-q6pv","description":"OneUptime has WhatsApp Resend Verification Authorization Bypass","datePublished":"Mar 10, 2026, 1:15:30 AM","dateUpdated":"Mar 10, 2026, 6:45:24 PM","baseScore":0.0,"references":"https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cw6x-mw64-q6pv\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-30959\nhttps://github.com/OneUptime/oneuptime\nhttps://github.com/OneUptime/oneuptime/releases/tag/10.0.21\n","enisa_id":"EUVD-2026-10703\n","aliases":"GHSA-cw6x-mw64-q6pv\nCVE-2026-30959\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:54:31 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e0261677-0d90-363b-8a8b-629cd94f2b64","vulnerability":{"id":"CVE-2026-30959","description":"OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verification code resend for any UserWhatsApp record by ID. Ownership is not validated (unlike the verify endpoint). This affects the UserWhatsAppAPI.ts endpoint and the UserWhatsAppService.ts service.","datePublished":"Mar 10, 2026, 5:06:33 PM","dateUpdated":"Mar 10, 2026, 5:59:05 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L","references":"https://github.com/OneUptime/oneuptime/security/advisories/GHSA-cw6x-mw64-q6pv\nhttps://github.com/OneUptime/oneuptime/releases/tag/10.0.21\n","enisa_id":"EUVD-2026-10703\n","assigner":"GitHub_M","epss":0.39,"dataProcessed":"Oct 27, 2026, 7:18:05 AM","vulnerabilityProduct":[{"id":"4801ee91-9b81-33ba-88db-5cab7ef768f4","product":{"name":"oneuptime","vendor":{"name":"OneUptime"}},"product_version":"\u003c 10.0.21"}],"vulnerabilityVendor":[{"id":"bb8e555d-b305-3e20-8a0c-f783c38c87f4","vendor":{"name":"OneUptime"}}]}}],"enisaIdAdvisory":[]}