https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T07:09:34.850257+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-275185 EUVD-2026-275185 2026-10-07T07:09:34.895423+00:00 EUVD-2026-275185 https://cve.radiocsirt.org/vuln/fkie_cve-2026-30920 fkie_cve-2026-30920 2026-10-07T07:09:34.895461+00:00

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installation_id values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the target project. This allows an attacker to overwrite another project's GitHub App installation binding. Related GitHub endpoints also lack effective authorization, so a valid installation ID can be used to enumerate repositories and create CodeRepository records in an arbitrary project. This vulnerability is fixed in 10.0.19.

 https://cve.radiocsirt.org/vuln/ghsa-656w-6f6c-m9r6 GHSA-656w-6f6c-m9r6 — OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding 2026-10-07T07:09:34.895498+00:00

Affected: npm: @oneuptime/common

### Summary

OneUptime's GitHub App callback trusts attacker-controlled `state` and `installation_id` values and updates `Project.gitHubAppInstallationId` with `isRoot: true` without validating that the caller is authorized for the target project. This allows an attacker to overwrite another project's GitHub App installation binding.

Related GitHub endpoints also lack effective authorization, so a valid installation ID can be used to enumerate repositories and create `CodeRepository` records in an arbitrary project.

### Details

The callback decodes unsigned base64 JSON from `state` and uses the embedded `projectId` directly:

- https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L34-L112

It then writes the supplied `installation_id` into the target project with root privileges:

```ts await ProjectService.updateOneById({ id: new ObjectID(projectId), data: { gitHubAppInstallationId: installationId }, props: { isRoot: true }, }); ```

The `userId` in `state` is only checked for presence, not authenticity:

- https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L73-L79

The install flow also generates `state` as plain base64 JSON, not a signed or session-bound token:

- https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L127-L165

The follow-on endpoints are also vulnerable:

- Repository listing: https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L…