OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding

Vulnerability

Overview

CVE-2026-30920 is an authorization bypass vulnerability in OneUptime versions prior to 10.0.19. The root cause is that the GitHub App OAuth callback trusts attacker-controlled state and installation_id parameters without verifying that the caller is authorized to modify the target project. This allows the attacker to overwrite any project's gitHubAppInstallationId, setting isRoot: true and effectively hijacking the GitHub App binding [1][2].

Attack

Vector and Exploitation

The attack is exploitable over the network without authentication: an attacker can craft a malicious OAuth callback URL incorporating arbitrary state and installation_id values. Additionally, related GitHub API endpoints lack effective authorization checks, so if the attacker possesses a valid GitHub App installation ID (e.g., obtained by installing their own malicious app), they can enumerate repositories and create CodeRepository records in any arbitrary project [1][4].

Impact

A successful attack allows the attacker to substitute another project's GitHub App installation binding with one they control. This enables listing of the victim project's repositories and creation of CodeRepository entries, potentially leading to unauthorized access to source code, secrets, and monitoring data tied to those repositories. The impact is high as it bypasses core multi-tenant isolation in a monitoring platform [1][3].

Mitigation

The vulnerability is fixed in OneUptime version 10.0.19. Users should upgrade immediately. No workarounds are documented; the patch introduces proper authorization validation in the GitHub callback handler and related endpoints [1].