PT-2026-24150 · Oneuptime · Oneuptime

Maru1009 · Published 2026-03-09 · Updated 2026-03-12 · CVE-2026-30920

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions OneUptime versions prior to 10.0.19

Description OneUptime’s GitHub App callback does not properly validate the state and installation id values received from a user, allowing an attacker to overwrite another project's GitHub App installation binding. The callback decodes base64 JSON from the state parameter and uses the embedded projectId directly. It then updates the Project.gitHubAppInstallationId with isRoot: true without verifying the caller's authorization for the target project. Related GitHub endpoints also lack effective authorization, enabling a valid installation ID to be used to enumerate repositories and create CodeRepository records in an arbitrary project. The vulnerable API endpoints include: /api/github/auth/callback, /api/github/repositories, and /api/github/connect. The state and installation id parameters are vulnerable.

Recommendations Versions prior to 10.0.19 should be updated to version 10.0.19 or later.

Exploit

Fix

Missing Authorization

Insufficient Verification of Data Authenticity

IDOR

Weakness Enumeration

CWE-862

CWE-345

CWE-639

Related Identifiers

CVE-2026-30920

GHSA-656W-6F6C-M9R6

Affected Products

Oneuptime

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30920.json · Exploit
• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-656w-6f6c-m9r6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30920 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30920 · Security Note
• https://osv.dev/vulnerability/GHSA-656w-6f6c-m9r6 · Vendor Advisory
• https://github.com/OneUptime/oneuptime · Note
• https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L260-L356 · Note
• https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L34-L112 · Note
• https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L73-L79 · Note
• https://github.com/OneUptime/oneuptime/blob/master/Common/Server/Utils/CodeRepository/GitHub/GitHub.ts#L347-L425 · Note
• https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L179-L258 · Note
• https://github.com/OneUptime/oneuptime/blob/master/Common/Server/Middleware/UserAuthorization.ts#L205-L211 · Note
• https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L127-L165 · Note
• https://twitter.com/TheHackerWire/status/2031429877409395144 · Twitter Post
• https://t.me/CVEtracker/46955 · Telegram Post