CVE-2026-30956: OneUptime Authorization Bypass Leading to Cross-Tenant Data Exposure and Account Takeover
Summary
CVE-2026-30956: A low‑privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 by sending a forged is-multi-tenant-query header together with a controlled projectid header. Affects @oneuptime/common versions < 10.0.21. Fixed in 10.0.21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OneUptime is a multi-tenant monitoring platform designed to help organizations manage their uptime and performance across various services. It allows users to create and manage projects, monitor service health, and collaborate with team members. However, a critical vulnerability has been identified in version 10.0.20 of the package '@oneuptime/common', which can lead to severe security issues, including unauthorized access to sensitive data and account takeovers.
Vulnerability Detail
The vulnerability arises from an authorization bypass due to the server's trust in a client-controlled header, specifically the 'is-multi-tenant-query' header. When a low-privileged user sends a forged header along with a controlled 'projectid', the server skips essential internal permission checks, allowing the attacker to access project data belonging to other tenants. This can lead to the exposure of sensitive user fields, including plaintext reset tokens, enabling attackers to reset victims' passwords and take over their accounts. The exploitation chain involves bypassing tenant isolation, reading victim project data, leaking sensitive credentials, and ultimately gaining full control over the victim's account.
How To Fix
Minimum fixed version
10.0.21
This is the first release that contains the fix.
npm install @oneuptime/common@10.0.21Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your application does not trust client-supplied headers for authorization checks. Implement server-side validation to enforce strict permission checks regardless of the 'is-multi-tenant-query' header.
Conclusion
The CVE-2026-30956 vulnerability in OneUptime poses significant risks to user data and account security. It is essential for users of the affected package to update to the patched version to safeguard against potential exploits. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for @oneuptime/common →
FAQ
CVE-2026-30956 is a critical vulnerability in the OneUptime platform that allows low-privileged users to bypass authorization checks, leading to cross-tenant data exposure and account takeover.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without needing to sign up.
The consequences include unauthorized access to other tenants' project data, exposure of sensitive user information, and the ability for attackers to reset passwords and take over accounts.
Yes, a patch is available in version 10.0.21 of the '@oneuptime/common' package. It is crucial to update to this version to mitigate the vulnerability.
If you cannot update immediately, implement server-side validation to prevent reliance on client-supplied headers for authorization checks as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for @oneuptime/common.
