OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header

Vulnerability

Overview In OneUptime prior to version 10.0.21, the server trusts a client-supplied HTTP header (is-multi-tenant-query) to determine whether to skip internal permission checks. When an attacker sends this header with a value of true, the server disables tenant isolation and skips authorization checks in BasePermission.ts, including table, query, and select permission validation [1][2]. This design flaw allows a low-privileged user to bypass security controls without authentication.

Exploitation

An attacker can exploit this by simply adding the is-multi-tenant-query: true and a controlled projectid header to any API request. The server then processes the request as if it were a multi-tenant query, bypassing all permission checks and tenant scoping. This requires no special privileges beyond a valid low-privileged account, and the attack can be performed remotely over the network [2].

Impact

Successful exploitation enables the attacker to access project data belonging to other tenants, read sensitive User fields (such as password, resetPasswordToken, and webauthnChallenge) via nested relations, and leak the plaintext reset token. Since the reset token is stored in plaintext, the attacker can immediately reset the victim's password and fully take over the account, resulting in cross-tenant data exposure and complete account compromise [1][2].

Mitigation

The vulnerability is fixed in OneUptime version 10.0.21, which removes trust in client-supplied headers for authorization decisions. Users are strongly advised to upgrade immediately [4]. No workarounds have been published.