8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30920

CVE-2026-30920: OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installation_id values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the target project. This allows an attacker to overwrite another project's GitHub App installation binding. Related GitHub endpoints also lack effective authorization, so a valid installation ID can be used to enumerate repositories and create CodeRepository records in an arbitrary project. This vulnerability is fixed in 10.0.19.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30920

CVE-2026-30920:

8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@oneuptime/common	npm	< 10.0.19	10.0.19

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The root cause of the vulnerability is a combination of insufficient data authenticity verification and missing authorization across multiple endpoints in the GitHub integration API. The state parameter, used to track the GitHub App installation flow, was not cryptographically signed, allowing an attacker to tamper with it and specify an arbitrary projectId. The main callback endpoint, /github/auth/callback, blindly trusted this tampered state and linked a GitHub installation to the victim's project without verifying if the user had the necessary permissions. Furthermore, related endpoints for listing and connecting repositories also lacked proper authorization checks, permitting unauthenticated users to enumerate repository metadata and create repository records in projects they did not have access to. The patch addresses these issues by replacing the insecure base64-encoded state with a signed JSON Web Token (JWT) and implementing strict authorization checks across all affected endpoints to ensure the user is a member of the target project.

Vulnerable functions

GitHubAPI.addRoutes

Common/Server/API/GitHubAPI.ts

The primary vulnerability exists in the `/github/auth/callback` route handler within the `addRoutes` method. It improperly trusts a `state` parameter that is only base64 encoded, not cryptographically signed. An attacker can craft a malicious `state` object containing a victim's `projectId`. The function proceeds to link the `installation_id` to this `projectId` without verifying if the user performing the action is authorized for that project. The patch fixes this by using a signed JWT for the `state` and adding an explicit authorization check.

GitHubAPI.addRoutes

Common/Server/API/GitHubAPI.ts

The `/github/install` route handler within the `addRoutes` method was responsible for generating the insecure `state` parameter. It created a simple base64-encoded JSON string, which could be easily decoded, manipulated, and re-encoded by an attacker to target a different project in the subsequent callback.

GitHubAPI.addRoutes

Common/Server/API/GitHubAPI.ts

The `/github/repositories/:projectId/:installationId` route handler within the `addRoutes` method lacked authorization checks. This allowed an attacker with a valid `installationId` to enumerate repositories, even if they were not authorized for the specified `projectId`. The patch added authentication and authorization checks to prevent this information disclosure.

GitHubAPI.addRoutes

Common/Server/API/GitHubAPI.ts

The `/github/repository/connect` route handler within the `addRoutes` method was missing authorization. This allowed an unauthenticated or unauthorized user to create `CodeRepository` records in arbitrary projects by simply supplying the victim's `projectId` in the request body.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.