CVE-2026-30956: OneUptime Auth Bypass Vulnerability

CVE-2026-30956 Overview

CVE-2026-30956 is a critical authorization bypass vulnerability affecting OneUptime, a solution for monitoring and managing online services. Prior to version 10.0.21, a low-privileged user can bypass authorization and tenant isolation by sending a forged is-multi-tenant-query header together with a controlled projectid header. Because the server trusts this client-supplied header, internal permission checks in BasePermission are skipped and tenant scoping is disabled, enabling cross-tenant data access and full account takeover.

Critical Impact

This vulnerability allows attackers to access project data belonging to other tenants, read sensitive User fields via nested relations, leak plaintext resetPasswordToken, and reset the victim's password for complete account takeover.

Affected Products

• Hackerbay OneUptime versions prior to 10.0.21
• OneUptime multi-tenant deployments with default configurations
• Self-hosted and cloud-based OneUptime instances running vulnerable versions

Discovery Timeline

• 2026-03-10 - CVE-2026-30956 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-30956

Vulnerability Analysis

This authorization bypass vulnerability stems from improper access control (CWE-285) in OneUptime's multi-tenant architecture. The application fails to properly validate the authenticity of HTTP headers used for tenant isolation and permission decisions. When a malicious actor crafts requests with the is-multi-tenant-query header set alongside a manipulated projectid header, the server incorrectly trusts these client-controlled values without verification.

The flaw exists in the BasePermission component, which uses these headers to determine whether multi-tenant query logic should be applied. By abusing this trust relationship, an authenticated but low-privileged attacker can effectively disable tenant scoping entirely, gaining unauthorized access to resources belonging to other tenants within the same OneUptime instance.

Root Cause

The root cause is the server's implicit trust of client-supplied HTTP headers for security-critical decisions. Specifically, the is-multi-tenant-query header was designed for internal use but is accessible to external clients. When this header is present in a request, the BasePermission module bypasses standard tenant isolation checks, assuming the request originates from a trusted internal service. This design flaw allows any authenticated user to escalate their privileges by simply including this header in their API requests.

Attack Vector

The attack vector is network-based and requires only low privileges—any authenticated user can exploit this vulnerability. An attacker can perform the following actions:

1. Authenticate to the OneUptime platform with any valid user account
2. Craft HTTP requests with the is-multi-tenant-query header set to bypass tenant isolation
3. Include a projectid header targeting another tenant's project
4. Access sensitive data including user records, monitoring configurations, and credentials
5. Retrieve plaintext resetPasswordToken values from victim accounts via nested relation queries
6. Use the obtained reset token to change the victim's password and achieve full account takeover

The vulnerability does not require user interaction and can be exploited remotely over the network. The scope is changed as the attacker can impact resources beyond the vulnerable component's security scope—specifically, data belonging to other tenants.

Detection Methods for CVE-2026-30956

Indicators of Compromise

• Unusual HTTP requests containing is-multi-tenant-query headers from external clients or non-administrative users
• API requests with mismatched projectid headers that do not correspond to the authenticated user's assigned projects
• Unexpected password reset token retrievals or account modifications across tenant boundaries
• Anomalous access patterns showing users querying resources outside their authorized tenant scope

Detection Strategies

• Implement web application firewall (WAF) rules to flag or block requests containing the is-multi-tenant-query header from external sources
• Enable detailed API request logging to capture all headers, especially focusing on tenant-related headers like projectid and is-multi-tenant-query
• Create SIEM correlation rules to detect authentication events followed by cross-tenant data access attempts
• Monitor for bulk data enumeration patterns that may indicate an attacker probing multiple tenant resources

Monitoring Recommendations

• Review API access logs for requests containing suspicious header combinations targeting tenant isolation mechanisms
• Audit password reset events and correlate with unusual account access patterns indicating potential takeover attempts
• Implement real-time alerting for any requests attempting to access the resetPasswordToken field or similar sensitive user attributes
• Establish baseline behavior for legitimate multi-tenant queries to identify anomalous deviations

How to Mitigate CVE-2026-30956

Immediate Actions Required

• Upgrade OneUptime to version 10.0.21 or later immediately, as this version contains the security fix
• Review access logs for any signs of exploitation prior to patching, specifically looking for the is-multi-tenant-query header in requests
• Rotate all user credentials and reset tokens that may have been exposed during the vulnerable period
• Notify affected tenants if any evidence of cross-tenant data access is discovered

Patch Information

The vulnerability is fixed in OneUptime version 10.0.21. Organizations should update to this version or later as soon as possible. The patch properly validates internal headers and prevents client-supplied values from bypassing tenant isolation. For detailed information about the fix, refer to the GitHub Release 10.0.21 and the GitHub Security Advisory GHSA-r5v6-2599-9g3m.

Workarounds

• Deploy a reverse proxy or WAF rule to strip or reject requests containing the is-multi-tenant-query header from external clients until the patch can be applied
• Implement network segmentation to restrict API access to trusted networks only while operating on vulnerable versions
• Temporarily disable external API access if feasible, limiting interactions to internal trusted sources until the upgrade is complete
• Enable enhanced logging and monitoring to detect exploitation attempts while the workaround is in place

# Example nginx configuration to block suspicious headers
# Add to server or location block before proxying to OneUptime
if ($http_is_multi_tenant_query) {
    return 403;
}