CVE-2026-30956

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 and earlier by sending a forged is-multi-tenant-query header together with a controlled projectid header. Because the server trusts this client-supplied header, internal permission checks in BasePermission are skipped and tenant scoping is disabled. This allows attackers to access project data belonging to other tenants, read sensitive User fields via nested relations, leak plaintext resetPasswordToken, and reset the victim’s password and fully take over the account. This results in cross‑tenant data exposure and full account takeover. This vulnerability is fixed in 10.0.21.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/OneUptime/oneuptime/releases/tag/10.0.21	Product Release Notes
https://github.com/OneUptime/oneuptime/security/advisories/GHSA-r5v6-2599-9g3m	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-10 18:18

Updated : 2026-03-12 14:11

NVD link : CVE-2026-30956

Mitre link : CVE-2026-30956

CVE.ORG link : CVE-2026-30956

JSON object : View

Products Affected

hackerbay

oneuptime

CWE

CWE-285

Improper Authorization

CWE-862

Missing Authorization

{"id": "CVE-2026-30956", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "published": "2026-03-10T18:18:54.587", "references": [{"url": "https://github.com/OneUptime/oneuptime/releases/tag/10.0.21", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-r5v6-2599-9g3m", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low\u2011privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 and earlier by sending a forged is-multi-tenant-query header together with a controlled projectid header. Because the server trusts this client-supplied header, internal permission checks in BasePermission are skipped and tenant scoping is disabled. This allows attackers to access project data belonging to other tenants, read sensitive User fields via nested relations, leak plaintext resetPasswordToken, and reset the victim\u2019s password and fully take over the account. This results in cross\u2011tenant data exposure and full account takeover. This vulnerability is fixed in 10.0.21."}, {"lang": "es", "value": "OneUptime es una soluci\u00f3n para monitorear y gestionar servicios en l\u00ednea. Antes de la 10.0.21, un usuario con bajos privilegios puede eludir la autorizaci\u00f3n y el aislamiento de inquilinos en OneUptime v10.0.20 y versiones anteriores enviando un encabezado 'is-multi-tenant-query' falsificado junto con un encabezado 'projectid' controlado. Debido a que el servidor conf\u00eda en este encabezado proporcionado por el cliente, se omiten las comprobaciones de permisos internas en BasePermission y el alcance de inquilinos se deshabilita. Esto permite a los atacantes acceder a datos de proyectos pertenecientes a otros inquilinos, leer campos de usuario sensibles a trav\u00e9s de relaciones anidadas, filtrar el 'resetPasswordToken' en texto plano, y restablecer la contrase\u00f1a de la v\u00edctima y tomar el control total de la cuenta. Esto resulta en exposici\u00f3n de datos entre inquilinos y una toma de control total de la cuenta. Esta vulnerabilidad se corrige en la 10.0.21."}], "lastModified": "2026-03-12T14:11:58.990", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED54DE0A-2CD8-4372-BECA-6F3AF29F2C2B", "versionEndExcluding": "10.0.21"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}