Security Flaw in OneUptime's GitHub App Impacting Project Data Management

CVE-2026-30920

What is CVE-2026-30920?

OneUptime, a service for monitoring online services, contains a vulnerability where its GitHub App callback improperly trusts values from attacker-controlled sources. Without adequate validation of authorization, this allows unauthorized users to modify Project.gitHubAppInstallationId with isRoot: true, leading to unauthorized overwrites of Project bindings. Furthermore, certain GitHub endpoints do not enforce strong authorization, enabling an attacker to manipulate installation IDs, enumerate repositories, and create CodeRepository records across different projects, potentially leading to significant security risks.

References