An unauthenticated information disclosure vulnerability exists in the GET /api/v1/status-page/:url endpoint.
The endpoint does not enforce authentication or verify whether a status page is published before returning full status page details.

As a result, unpublished status pages and their associated internal data are accessible to any unauthenticated user via direct API requests.

Affected Component:
File: server/src/routes/statusPageRoute.ts
Endpoint: GET /api/v1/status-page/:url?type=uptime

Vulnerability Details

The route handler:

this.router.get("/:url", this.statusPageController.getStatusPageByUrl);

does not use the verifyJWT middleware.

The controller method:

getStatusPageByUrl = async (req, res, next) => {
    const statusPage = await this.statusPageService.getStatusPageByUrl(url);
    return res.json({ data: { statusPage, monitors } });
};

lacks:

• Authentication checks
• Validation of the isPublished flag for public access

This allows unauthenticated users to retrieve full status page data, including unpublished pages.

PoC:
Send the following curl command:

curl http://localhost:52347/api/v1/status-page/<status-page-address>?type=uptime

Impact:
Unpublished (private) status pages are exposed publicly, leading to unintended data disclosure.