Authorization Bypass Vulnerability in OneUptime by OneUptime
CVE-2026-30956

10CRITICAL

Key Information:

Vendor

Oneuptime

Status
Oneuptime
Vendor
CVE Published:
10 March 2026

What is CVE-2026-30956?

Prior to version 10.0.21, OneUptime contained a vulnerability that allowed low-privileged users to bypass authorization and tenant isolation. By forging the 'is-multi-tenant-query' header alongside a manipulated 'projectid' header, attackers could disable internal permission checks, leading to unauthorized access to project data across different tenants. This vulnerability could enable attackers to read sensitive user information via nested relations, leak plaintext resetPasswordTokens, reset victims' passwords, and ultimately take over accounts. The issue has been resolved in version 10.0.21, reinforcing the importance of updating to mitigate potential risks of unauthorized data access.

Affected Version(s)

oneuptime < 10.0.21

References

https://github.com/OneUptime/oneuptime/security/advisorie...
x_refsource_CONFIRM
https://github.com/OneUptime/oneuptime/releases/tag/10.0.21
x_refsource_MISC

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.