CVE-2026-30920: Oneuptime Auth Bypass Vulnerability

CVE-2026-30920 Overview

OneUptime is a solution for monitoring and managing online services. Prior to version 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installation_id values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the target project. This allows an attacker to overwrite another project's GitHub App installation binding. Related GitHub endpoints also lack effective authorization, so a valid installation ID can be used to enumerate repositories and create CodeRepository records in an arbitrary project.

Critical Impact

This authorization bypass vulnerability enables attackers to hijack GitHub App installations for arbitrary projects, potentially compromising code repository integrations and enabling unauthorized access to connected repositories across multiple projects.

Affected Products

• Hackerbay OneUptime versions prior to 10.0.19

Discovery Timeline

• 2026-03-10 - CVE CVE-2026-30920 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-30920

Vulnerability Analysis

This vulnerability stems from insufficient verification of data sufficiency (CWE-345) in the OneUptime GitHub App callback mechanism. The application fails to validate that incoming OAuth callback requests originate from legitimate, authorized users before processing critical project configuration changes.

When a user initiates a GitHub App installation flow, the application generates a callback URL containing state parameters. Upon return from GitHub's OAuth flow, the application blindly trusts the state and installation_id parameters provided in the callback request. The vulnerable code path updates the Project.gitHubAppInstallationId field using elevated privileges (isRoot: true) without verifying the requesting user has authorization to modify the target project.

This design flaw enables a malicious actor to craft callback requests targeting arbitrary projects, effectively hijacking their GitHub App installation bindings. Once an attacker has overwritten a project's installation ID, they can leverage related GitHub endpoints that also lack proper authorization checks to enumerate repositories associated with the hijacked installation and create unauthorized CodeRepository records within the victim's project.

Root Cause

The root cause is a missing authorization check in the GitHub App OAuth callback handler. The application processes callback parameters with elevated system privileges without validating that the authenticated user has permission to modify the specified project's GitHub integration settings. This represents a classic broken access control vulnerability where trust boundaries are not properly enforced for attacker-controllable input.

Attack Vector

An attacker can exploit this vulnerability remotely over the network without requiring any prior authentication or user interaction. The attack flow involves:

1. The attacker initiates a legitimate GitHub App installation flow for their own project
2. During the OAuth callback phase, the attacker modifies the state parameter to reference a victim's project ID
3. The attacker submits the manipulated callback request to the OneUptime server
4. The server processes the request with isRoot: true privileges, overwriting the victim project's GitHub App installation binding
5. The attacker can then use the bound installation ID to enumerate repositories and create unauthorized code repository records in the victim's project

The vulnerability mechanism involves the callback handler accepting attacker-controlled parameters and directly using them to update database records without authorization validation. For complete technical details, see the GitHub Security Advisory.

Detection Methods for CVE-2026-30920

Indicators of Compromise

• Unexpected changes to gitHubAppInstallationId values in project configurations
• Audit log entries showing GitHub App installation bindings modified by unauthorized users
• New CodeRepository records appearing in projects without corresponding user actions
• Multiple GitHub callback requests targeting different project IDs from the same session

Detection Strategies

• Monitor audit logs for modifications to GitHub integration settings, particularly Project.gitHubAppInstallationId updates
• Implement anomaly detection for GitHub OAuth callback requests that reference projects the authenticated user doesn't own
• Alert on creation of CodeRepository records by users without appropriate project permissions
• Review application logs for callback requests with mismatched session state and project ownership

Monitoring Recommendations

• Enable comprehensive logging for all GitHub App OAuth callback endpoints
• Configure alerts for bulk or rapid changes to GitHub integration settings across multiple projects
• Implement real-time monitoring for privilege escalation patterns in project configuration changes
• Establish baseline metrics for normal GitHub integration activity to detect anomalous behavior

How to Mitigate CVE-2026-30920

Immediate Actions Required

• Upgrade OneUptime to version 10.0.19 or later immediately
• Audit all existing GitHub App installation bindings for unauthorized modifications
• Review recent CodeRepository creation events for signs of exploitation
• Temporarily disable GitHub App integrations if immediate upgrade is not possible

Patch Information

This vulnerability is fixed in OneUptime version 10.0.19. The patch implements proper authorization checks in the GitHub App callback handler to validate that the requesting user has permission to modify the target project before processing installation binding updates. Organizations should upgrade to this version or later to remediate the vulnerability. For additional details, refer to the GitHub Security Advisory.

Workarounds

• Restrict network access to OneUptime GitHub callback endpoints to trusted IP ranges where possible
• Implement additional authentication requirements for GitHub integration management
• Monitor and audit all GitHub App installation changes manually until patching is complete
• Consider temporarily removing GitHub App integrations from high-value projects until the upgrade is applied