PT-2026-24150 · Oneuptime · Oneuptime

Maru1009 · Publicado 2026-03-09 · Atualizado 2026-03-12 · CVE-2026-30920

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions OneUptime versions prior to 10.0.19

Description OneUptime’s GitHub App callback does not properly validate the state and installation id values received from a user, allowing an attacker to overwrite another project's GitHub App installation binding. The callback decodes base64 JSON from the state parameter and uses the embedded projectId directly. It then updates the Project.gitHubAppInstallationId with isRoot: true without verifying the caller's authorization for the target project. Related GitHub endpoints also lack effective authorization, enabling a valid installation ID to be used to enumerate repositories and create CodeRepository records in an arbitrary project. The vulnerable API endpoints include: /api/github/auth/callback, /api/github/repositories, and /api/github/connect. The state and installation id parameters are vulnerable.

Recommendations Versions prior to 10.0.19 should be updated to version 10.0.19 or later.

Exploit

Correção

Missing Authorization

Insufficient Verification of Data Authenticity

IDOR

Enumeração de Fraquezas

CWE-862

CWE-345

CWE-639

Identificadores relacionados

CVE-2026-30920

GHSA-656W-6F6C-M9R6

Produtos afetados

Oneuptime

Referências · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30920.json · Exploit
• https://github.com/OneUptime/oneuptime · Nota
• https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L260-L356 · Nota
• https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L34-L112 · Nota
• https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L73-L79 · Nota
• https://github.com/OneUptime/oneuptime/blob/master/Common/Server/Utils/CodeRepository/GitHub/GitHub.ts#L347-L425 · Nota
• https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L179-L258 · Nota
• https://github.com/OneUptime/oneuptime/blob/master/Common/Server/Middleware/UserAuthorization.ts#L205-L211 · Nota
• https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L127-L165 · Nota
• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-656w-6f6c-m9r6 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2031429877409395144 · Publicação no Twitter
• https://t.me/CVEtracker/46955 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2031294594990903693 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2031177604816834860 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-30920 · Aviso do Fabricante