Executive brief
statping-ng is an open-source website monitoring and uptime tracking tool. A flaw in its authentication logic allows any authenticated user with a valid API key to escalate their privileges to full administrator status, even if they were created as a non-admin account. An attacker who obtains any legitimate user's API key can use it to create new administrator accounts and gain complete control of the monitoring system and sensitive infrastructure data.
Technical details
statping-ng v0.93.0 contains an improper access control vulnerability (CWE-284) in its authentication handlers. The vulnerability exists in handlers/authentication.go::hasAPIQuery() and handlers/handlers.go::IsFullAuthenticated(), which accept any valid user API key as sufficient authentication for administrative endpoints without verifying that the key belongs to an administrator user. Routes protected by the authenticated() middleware (e.g., POST /api/users) trust the IsFullAuthenticated() result before enforcing administrator-role boundaries. An attacker with a non-admin user's API key can invoke the api query parameter on administrative endpoints to create new administrator accounts or modify sensitive configurations. The attack requires network access and a valid (non-admin) API key but no additional user interaction. No patch is currently available for v0.93.0 or earlier versions. The root cause is the failure to distinguish between user-level and administrator-level API credentials before authorizing sensitive operations.
Affected products
- statping-ng statping-ng <= 0.93.0
Timeline
- 2026-06-15: disclosed
- 2026-06-15: advisory: Published to GitHub Advisory Database