CVE-2026-30956

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30956", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-07T17:34:39.981Z", "datePublished": "2026-03-10T16:56:29.018Z", "dateUpdated": "2026-03-10T19:06:41.378Z"}, "containers": {"cna": {"title": "OneUptime has authorization bypass via client\u2011controlled is-multi-tenant-query header", "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "lang": "en", "description": "CWE-285: Improper Authorization", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-r5v6-2599-9g3m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-r5v6-2599-9g3m"}, {"name": "https://github.com/OneUptime/oneuptime/releases/tag/10.0.21", "tags": ["x_refsource_MISC"], "url": "https://github.com/OneUptime/oneuptime/releases/tag/10.0.21"}], "affected": [{"vendor": "OneUptime", "product": "oneuptime", "versions": [{"version": "< 10.0.21", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T16:56:29.018Z"}, "descriptions": [{"lang": "en", "value": "OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low\u2011privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 and earlier by sending a forged is-multi-tenant-query header together with a controlled projectid header. Because the server trusts this client-supplied header, internal permission checks in BasePermission are skipped and tenant scoping is disabled. This allows attackers to access project data belonging to other tenants, read sensitive User fields via nested relations, leak plaintext resetPasswordToken, and reset the victim\u2019s password and fully take over the account. This results in cross\u2011tenant data exposure and full account takeover. This vulnerability is fixed in 10.0.21."}], "source": {"advisory": "GHSA-r5v6-2599-9g3m", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T18:25:16.132245Z", "id": "CVE-2026-30956", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T19:06:41.378Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30956", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-10T18:25:16.132245Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T18:25:34.148Z"}}], "cna": {"title": "OneUptime has authorization bypass via client\u2011controlled is-multi-tenant-query header", "source": {"advisory": "GHSA-r5v6-2599-9g3m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "OneUptime", "product": "oneuptime", "versions": [{"status": "affected", "version": "< 10.0.21"}]}], "references": [{"url": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-r5v6-2599-9g3m", "name": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-r5v6-2599-9g3m", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/OneUptime/oneuptime/releases/tag/10.0.21", "name": "https://github.com/OneUptime/oneuptime/releases/tag/10.0.21", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low\u2011privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 and earlier by sending a forged is-multi-tenant-query header together with a controlled projectid header. Because the server trusts this client-supplied header, internal permission checks in BasePermission are skipped and tenant scoping is disabled. This allows attackers to access project data belonging to other tenants, read sensitive User fields via nested relations, leak plaintext resetPasswordToken, and reset the victim\u2019s password and fully take over the account. This results in cross\u2011tenant data exposure and full account takeover. This vulnerability is fixed in 10.0.21."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285: Improper Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-10T16:56:29.018Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30956", "state": "PUBLISHED", "dateUpdated": "2026-03-10T19:06:41.378Z", "dateReserved": "2026-03-07T17:34:39.981Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-10T16:56:29.018Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "oneuptime", "vendor": "OneUptime", "versions": [{"status": "affected", "version": "< 10.0.21"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hackerbay:oneuptime:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED54DE0A-2CD8-4372-BECA-6F3AF29F2C2B", "versionEndExcluding": "10.0.21", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low\u2011privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 and earlier by sending a forged is-multi-tenant-query header together with a controlled projectid header. Because the server trusts this client-supplied header, internal permission checks in BasePermission are skipped and tenant scoping is disabled. This allows attackers to access project data belonging to other tenants, read sensitive User fields via nested relations, leak plaintext resetPasswordToken, and reset the victim\u2019s password and fully take over the account. This results in cross\u2011tenant data exposure and full account takeover. This vulnerability is fixed in 10.0.21."}, {"lang": "es", "value": "OneUptime es una soluci\u00f3n para monitorear y gestionar servicios en l\u00ednea. Antes de la 10.0.21, un usuario con bajos privilegios puede eludir la autorizaci\u00f3n y el aislamiento de inquilinos en OneUptime v10.0.20 y versiones anteriores enviando un encabezado 'is-multi-tenant-query' falsificado junto con un encabezado 'projectid' controlado. Debido a que el servidor conf\u00eda en este encabezado proporcionado por el cliente, se omiten las comprobaciones de permisos internas en BasePermission y el alcance de inquilinos se deshabilita. Esto permite a los atacantes acceder a datos de proyectos pertenecientes a otros inquilinos, leer campos de usuario sensibles a trav\u00e9s de relaciones anidadas, filtrar el 'resetPasswordToken' en texto plano, y restablecer la contrase\u00f1a de la v\u00edctima y tomar el control total de la cuenta. Esto resulta en exposici\u00f3n de datos entre inquilinos y una toma de control total de la cuenta. Esta vulnerabilidad se corrige en la 10.0.21."}], "id": "CVE-2026-30956", "lastModified": "2026-10-07T08:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30956", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T18:25:16.132245Z", "version": "2.0.3"}}]}, "published": "2026-03-10T18:18:54.587", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/OneUptime/oneuptime/releases/tag/10.0.21"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-r5v6-2599-9g3m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.0.21)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "oneuptime", "source": "cna", "vendor": "OneUptime"}, "product": "oneuptime", "vendor": "oneuptime"}], "analysis": {"en": {"generated_at": "2026-04-16T09:43:46.579502+00:00", "value": {"mitigation_remediation": ["Upgrade to OneUptime version\u202f10.0.21 or later to apply the vendor fix.", "Check the vendor\u2019s website or security advisories for any additional patches and apply them promptly.", "Audit projects for unauthorized cross\u2011tenant data access, reset passwords for accounts that may have been compromised, and verify permissions."], "summary": {"action": "Immediate Patch", "impact": "Authorization bypass leading to cross\u2011tenant data exposure and account takeover"}, "threat_synthesis": {"affected_systems": "Affected deployments are those running OneUptime version 10.0.20 or earlier. The vulnerability was fixed in release 10.0.21. All installations of OneUptime that have not applied the latest patch remain vulnerable.", "description_and_impact": "The vulnerability originates from a client\u2011controlled is\u2011multi\u2011tenant\u2011query header that, when forged together with a projectid header, causes the server to skip internal permission checks in BasePermission. This authorization bypass allows a low\u2011privileged user to read data from other tenants, expose sensitive user information such as resetPasswordToken, and reset victim passwords, leading to full account takeover. The weakness is classified by CWE\u2011285 and CWE\u2011862.", "risk_and_exploitability": "Risk is severe with a CVSS score of 10 and an EPSS of <1\u202f%. The CVE enables a low\u2011privileged user to forge the is\u2011multi\u2011tenant\u2011query and projectid headers, bypassing permission checks and allowing read access to other tenants\u2019 data, exposure of sensitive user fields, and full account takeover. No public exploits have been reported, and the vulnerability is not listed in the KEV catalog."}}}}, "created": "2026-03-11T11:49:04.686894+00:00", "updated": "2026-04-16T09:45:31.680016+00:00", "vendors": ["oneuptime", "oneuptime$PRODUCT$oneuptime"]}