CVE-2026-30920

{"id": "CVE-2026-30920", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30920", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T14:14:27.669573Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "OneUptime", "product": "oneuptime", "versions": [{"status": "affected", "version": "< 10.0.19"}]}]}], "published": "2026-03-10T17:40:16.000", "references": [{"url": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-656w-6f6c-m9r6", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-345"}, {"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installation_id values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the target project. This allows an attacker to overwrite another project's GitHub App installation binding. Related GitHub endpoints also lack effective authorization, so a valid installation ID can be used to enumerate repositories and create CodeRepository records in an arbitrary project. This vulnerability is fixed in 10.0.19."}, {"lang": "es", "value": "OneUptime es una soluci\u00f3n para monitorear y gestionar servicios en l\u00ednea. Antes de 10.0.19, la devoluci\u00f3n de llamada de la aplicaci\u00f3n GitHub de OneUptime conf\u00eda en valores de estado y installation_id controlados por el atacante y actualiza Project.gitHubAppInstallationId con isRoot: true sin validar que el llamador est\u00e9 autorizado para el proyecto objetivo. Esto permite a un atacante sobrescribir la vinculaci\u00f3n de instalaci\u00f3n de la aplicaci\u00f3n GitHub de otro proyecto. Los puntos finales de GitHub relacionados tambi\u00e9n carecen de autorizaci\u00f3n efectiva, por lo que un ID de instalaci\u00f3n v\u00e1lido puede ser utilizado para enumerar repositorios y crear registros de CodeRepository en un proyecto arbitrario. Esta vulnerabilidad se corrige en 10.0.19."}], "lastModified": "2026-06-17T10:33:09.093", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9642D1F1-F28F-4272-A98F-F33919F80F21", "versionEndExcluding": "10.0.19"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}