9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30956

CVE-2026-30956: OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 and earlier by sending a forged is-multi-tenant-query header together with a controlled projectid header. Because the server trusts this client-supplied header, internal permission checks in BasePermission are skipped and tenant scoping is disabled. This allows attackers to access project data belonging to other tenants, read sensitive User fields via nested relations, leak plaintext resetPasswordToken, and reset the victim’s password and fully take over the account. This results in cross‑tenant data exposure and full account takeover. This vulnerability is fixed in 10.0.21.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30956

CVE-2026-30956:

9.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@oneuptime/common	npm	< 10.0.21	10.0.21

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from the application's backend improperly trusting a client-controlled HTTP header, is-multi-tenant-query. When this header was set to true, a flag was enabled that caused critical authorization and tenant isolation checks to be skipped. The core of the issue was in the TenantPermission.addTenantScopeToQuery and ModelPermission.addTenantScopeToQuery functions, where the logic to enforce tenant-scoping on database queries was bypassed. This allowed any authenticated user, regardless of their privilege level, to read and modify data belonging to any other tenant on the platform.

The severity of this authorization bypass was significantly amplified by a secondary weakness: password reset tokens were stored in plaintext. An attacker could exploit the tenant isolation bypass to query the Project model of a victim. By including the createdByUser relation in the query, they could access sensitive fields on the User model, including the plaintext resetPasswordToken. The exploitation chain involved triggering a password reset for a victim and then immediately using the tenant bypass to read the newly generated token from the database, allowing for a complete account takeover. The patches address both issues: first, by correcting the faulty logic in the permission-checking functions to properly handle the is-multi-tenant-query case, and second, by implementing hashing for all password reset tokens to prevent them from being useful even if leaked.

Vulnerable functions

TenantPermission.addTenantScopeToQuery

Common/Server/Types/Database/Permissions/TenantPermission.ts

This function is responsible for adding tenant-based restrictions to database queries. The vulnerability lies in the original logic that allowed a user to bypass tenant isolation. By sending the `is-multi-tenant-query` header, `props.isMultiTenantRequest` becomes true and `props.tenantId` can be null. The original condition `!props.tenantId && props.userGlobalAccessPermission` was too permissive and allowed queries to execute without a tenant scope, leading to cross-tenant data access.

ModelPermission.addTenantScopeToQuery

Common/Server/Types/AnalyticsDatabase/ModelPermission.ts

Similar to `TenantPermission.addTenantScopeToQuery`, this function in the analytics database context had the same logical flaw. It failed to properly enforce tenant boundaries when the `is-multi-tenant-query` header was present, allowing an attacker to bypass tenant isolation and access data from other tenants in the analytics database.

Authentication.forgotPasswordHandler

App/FeatureSet/Identity/API/Authentication.ts

The route handler for the 'forgot-password' functionality generated a password reset token and stored it in plaintext in the database. This plaintext token could be leaked using the cross-tenant data access vulnerability, which allowed an attacker to read sensitive fields from the User model of any tenant. Leaking this token enabled a full account takeover. The function is the anonymous callback for the `router.post` call.

StatusPageAuthentication.forgotPasswordHandler

App/FeatureSet/Identity/API/StatusPageAuthentication.ts

Similar to the main application's authentication, the 'forgot-password' handler for status page users also stored the password reset token in plaintext. This exposed status page user accounts to the same takeover risk if the token was leaked via the tenant isolation bypass.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.