https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 08:45:14 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-275325 EUVD-2026-275325 https://cve.radiocsirt.org/vuln/euvd-2026-275325 https://cve.radiocsirt.org/vuln/fkie_cve-2026-30956 <p>OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 and earlier by sending a forged is-multi-tenant-query header together with a controlled projectid header. Because the server trusts this client-supplied header, internal permission checks in BasePermission are skipped and tenant scoping is disabled. This allows attackers to access project data belonging to other tenants, read sensitive User fields via nested relations, leak plaintext resetPasswordToken, and reset the victim’s password and fully take over the account. This results in cross‑tenant data exposure and full account takeover. This vulnerability is fixed in 10.0.21.</p> <p>OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 and earlier by sending a forged is-multi-tenant-query header together with a controlled projectid header. Because the server trusts this client-supplied header, internal permission checks in BasePermission are skipped and tenant scoping is disabled. This allows attackers to access project data belonging to other tenants, read sensitive User fields via nested relations, leak plaintext resetPasswordToken, and reset the victim’s password and fully take over the account. This results in cross‑tenant data exposure and full account takeover. This vulnerability is fixed in 10.0.21.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-30956 https://cve.radiocsirt.org/vuln/ghsa-r5v6-2599-9g3m <p><strong>Affected:</strong> npm: @oneuptime/common</p> <p>### Summary A low‑privileged user can bypass authorization and tenant isolation in OneUptime `v10.0.20` by sending a forged `is-multi-tenant-query` header together with a controlled `projectid` header.</p> <p>Because the server trusts this client-supplied header, internal permission checks in `BasePermission` are skipped and tenant scoping is disabled.</p> <p>This allows attackers to:</p> <p>1. Access project data belonging to other tenants 2. Read sensitive User fields via nested relations 3. Leak plaintext resetPasswordToken 4. Reset the victim’s password and fully take over the account</p> <p>This results in cross‑tenant data exposure and full account takeover.</p> <p>### Details</p> <p>Root cause</p> <p>The API trusts a client‑controlled header to determine whether a request should bypass authorization checks.</p> <p>CommonAPI.ts ``` if (req.headers[&#34;is-multi-tenant-query&#34;]) { props.isMultiTenantRequest = true; } ``` BasePermission.ts ``` if (!props.isMultiTenantRequest) { TablePermission.checkTableLevelPermissions(...) QueryPermission.checkQueryPermission(...) SelectPermission.checkSelectPermission(...) } ``` When the attacker sends: ``` is-multi-tenant-query: true ``` the system skips all authorization checks including:</p> <p>- Table permission validation - Query permission validation - Select permission validation - Tenant isolation enforcement</p> <p>Additionally, tenant scoping is disabled in `TenantPermission`</p> <p>Sensitive user data exposure</p> <p>Projects marked with: ``` @MultiTenentQueryAllowed(true) ``` allow cross-te…</p> <p><strong>Affected:</strong> npm: @oneuptime/common</p> <p>### Summary A low‑privileged user can bypass authorization and tenant isolation in OneUptime `v10.0.20` by sending a forged `is-multi-tenant-query` header together with a controlled `projectid` header.</p> <p>Because the server trusts this client-supplied header, internal permission checks in `BasePermission` are skipped and tenant scoping is disabled.</p> <p>This allows attackers to:</p> <p>1. Access project data belonging to other tenants 2. Read sensitive User fields via nested relations 3. Leak plaintext resetPasswordToken 4. Reset the victim’s password and fully take over the account</p> <p>This results in cross‑tenant data exposure and full account takeover.</p> <p>### Details</p> <p>Root cause</p> <p>The API trusts a client‑controlled header to determine whether a request should bypass authorization checks.</p> <p>CommonAPI.ts ``` if (req.headers[&#34;is-multi-tenant-query&#34;]) { props.isMultiTenantRequest = true; } ``` BasePermission.ts ``` if (!props.isMultiTenantRequest) { TablePermission.checkTableLevelPermissions(...) QueryPermission.checkQueryPermission(...) SelectPermission.checkSelectPermission(...) } ``` When the attacker sends: ``` is-multi-tenant-query: true ``` the system skips all authorization checks including:</p> <p>- Table permission validation - Query permission validation - Select permission validation - Tenant isolation enforcement</p> <p>Additionally, tenant scoping is disabled in `TenantPermission`</p> <p>Sensitive user data exposure</p> <p>Projects marked with: ``` @MultiTenentQueryAllowed(true) ``` allow cross-te…</p> https://cve.radiocsirt.org/vuln/ghsa-r5v6-2599-9g3m