OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-345.
Summary
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installation_id values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the target project. This allows an attacker to overwrite another project's GitHub App installation binding. Related GitHub endpoints also lack effective authorization, so a valid installation ID can be used to enumerate repositories and create CodeRepository records in an arbitrary project. This vulnerability is fixed in 10.0.19.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OneUptime | oneuptime | before 10.0.19 | 10.0.19 | Patch available | CNA |
| — | @oneuptime/common (npm) | before 10.0.19 | 10.0.19 | Patch available | GHSA-656w-6f6c-m9r6 |
- oneuptime VendorOneUptime Affected before 10.0.19 Fixed in 10.0.19 Patch available CNA
- @oneuptime/common (npm) Vendor— Affected before 10.0.19 Fixed in 10.0.19 Patch available GHSA-656w-6f6c-m9r6
Remediation
- Fix · CNA oneuptime (OneUptime) Fixed in 10.0.19
- Fix · GHSA-656w-6f6c-m9r6 @oneuptime/common (npm) Fixed in 10.0.19 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-30920
- 2026-10-03 Alias added: GHSA-656w-6f6c-m9r6
References
Other 8
- https://github.com/OneUptime/oneuptime
- https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L127-L165
- https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L179-L258
- https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L260-L356
- https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L34-L112
- https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L73-L79
- https://github.com/OneUptime/oneuptime/blob/master/Common/Server/Middleware/UserAuthorization.ts#L205-L211
- https://github.com/OneUptime/oneuptime/blob/master/Common/Server/Utils/CodeRepository/GitHub/GitHub.ts#L347-L425
More Oneuptime vulnerabilities
- TI-2026-22090 OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec() CVSS 3.1CRITICAL 10.0
- TI-2026-27002 OneUptime: Missing Authentication on Notification Endpoints CVSS 3.1CRITICAL 9.1
- TI-2026-25573 OneUptime: WhatsApp Webhook Missing Signature Verification CVSS 4.0HIGH 8.7
- TI-2025-40534 OneUptime Unauthorized User Creation via API CVSS 4.0HIGH 8.8
- TI-2026-25793 Protection mechanism failure in oneuptime CVSS 3.1CRITICAL 10.0
- TI-2026-24835 OneUptime ClickHouse SQL Injection via Aggregate Query Parameters CVSS 3.1CRITICAL 10.0
Sources
- CVE-2026-30920 · CVE Program
- CVE-2026-30920 · NVD
- FIRST EPSS
- GHSA-656w-6f6c-m9r6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences