https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 07:53:18 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-275185 EUVD-2026-275185 https://cve.radiocsirt.org/vuln/euvd-2026-275185 https://cve.radiocsirt.org/vuln/fkie_cve-2026-30920 <p>OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime&#39;s GitHub App callback trusts attacker-controlled state and installation_id values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the target project. This allows an attacker to overwrite another project&#39;s GitHub App installation binding. Related GitHub endpoints also lack effective authorization, so a valid installation ID can be used to enumerate repositories and create CodeRepository records in an arbitrary project. This vulnerability is fixed in 10.0.19.</p> <p>OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime&#39;s GitHub App callback trusts attacker-controlled state and installation_id values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the target project. This allows an attacker to overwrite another project&#39;s GitHub App installation binding. Related GitHub endpoints also lack effective authorization, so a valid installation ID can be used to enumerate repositories and create CodeRepository records in an arbitrary project. This vulnerability is fixed in 10.0.19.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-30920 https://cve.radiocsirt.org/vuln/ghsa-656w-6f6c-m9r6 <p><strong>Affected:</strong> npm: @oneuptime/common</p> <p>### Summary</p> <p>OneUptime&#39;s GitHub App callback trusts attacker-controlled `state` and `installation_id` values and updates `Project.gitHubAppInstallationId` with `isRoot: true` without validating that the caller is authorized for the target project. This allows an attacker to overwrite another project&#39;s GitHub App installation binding.</p> <p>Related GitHub endpoints also lack effective authorization, so a valid installation ID can be used to enumerate repositories and create `CodeRepository` records in an arbitrary project.</p> <p>### Details</p> <p>The callback decodes unsigned base64 JSON from `state` and uses the embedded `projectId` directly:</p> <p>- https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L34-L112</p> <p>It then writes the supplied `installation_id` into the target project with root privileges:</p> <p>```ts await ProjectService.updateOneById({ id: new ObjectID(projectId), data: { gitHubAppInstallationId: installationId }, props: { isRoot: true }, }); ```</p> <p>The `userId` in `state` is only checked for presence, not authenticity:</p> <p>- https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L73-L79</p> <p>The install flow also generates `state` as plain base64 JSON, not a signed or session-bound token:</p> <p>- https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L127-L165</p> <p>The follow-on endpoints are also vulnerable:</p> <p>- Repository listing: https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L…</p> <p><strong>Affected:</strong> npm: @oneuptime/common</p> <p>### Summary</p> <p>OneUptime&#39;s GitHub App callback trusts attacker-controlled `state` and `installation_id` values and updates `Project.gitHubAppInstallationId` with `isRoot: true` without validating that the caller is authorized for the target project. This allows an attacker to overwrite another project&#39;s GitHub App installation binding.</p> <p>Related GitHub endpoints also lack effective authorization, so a valid installation ID can be used to enumerate repositories and create `CodeRepository` records in an arbitrary project.</p> <p>### Details</p> <p>The callback decodes unsigned base64 JSON from `state` and uses the embedded `projectId` directly:</p> <p>- https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L34-L112</p> <p>It then writes the supplied `installation_id` into the target project with root privileges:</p> <p>```ts await ProjectService.updateOneById({ id: new ObjectID(projectId), data: { gitHubAppInstallationId: installationId }, props: { isRoot: true }, }); ```</p> <p>The `userId` in `state` is only checked for presence, not authenticity:</p> <p>- https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L73-L79</p> <p>The install flow also generates `state` as plain base64 JSON, not a signed or session-bound token:</p> <p>- https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L127-L165</p> <p>The follow-on endpoints are also vulnerable:</p> <p>- Repository listing: https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L…</p> https://cve.radiocsirt.org/vuln/ghsa-656w-6f6c-m9r6