CVE-2026-30920Disclosure(hackerbay / oneuptime)

LOWCVSS 8.6 · HIGH

Signal is active with 6 mentions in latest observed window

Immediate actions

Patch hackerbay oneuptime systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installation_id values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the target project. This allows an attacker to overwrite another project's GitHub App installation binding. Related GitHub endpoints also lack effective authorization, so a valid installation ID can be used to enumerate repositories and create CodeRepository records in an arbitrary project. This vulnerability is fixed in 10.0.19.

hackerbay CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/OneUptime/oneuptime/security/advisories/GHSA-656w-6f6c-m9r6

Weakness type (CWE)

CWE-345CWE-639CWE-862

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

oneuptime

Threat summary

Patch or workaround signal is available
7 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 7 signals
Disclosure: 4 classified signals
Peaked at 6 mentions on most recent observed day (2026-03-10)
7 total mentions across 2 days

Affected systems

Vendors

hackerbay

Products

oneuptime

Deep dive

Activity timeline7 mentions / 2d

Signal classification2 categories

Disclosure

457.1%

Patch

342.9%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-09	1	Disclosure1
2026-03-10	6	Disclosure3Patch3

Full discourse7 posts

Vulmon Vulnerability Feed@VulmonFeeds212d
Disclosure
CVE-2026-30920 GitHub App Authorization Bypass in OneUptime Before 10.0.19 Enabling Project Takeover https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-30920
Post summary
The CVE-2026-30920 vulnerability is an authorization bypass in OneUptime versions prior to 10.0.19 that permits project takeover; no PoC, exploit, or patch details are provided.
0001038
4.0K followersView on X
CVEFind.com@CveFindCom212d
Patch
[CVE-2026-30920: HIGH] OneUptime's GitHub App vulnerability in versions prior to 10.0.19 allows attackers to overwrite GitHub App installation bindings. Patched in version 10.0.19. #cybersecurity#cve,CVE-2026-30920,#cybersecurity https://cvefind.com/CVE-2026-30920
Post summary
OneUptime addressed CVE‑2026‑30920 by patching it in version 10.0.19, fixing a vulnerability that allowed overwriting GitHub App installation bindings; no active exploitation or PoC is mentioned.
0000030
601 followersView on X
The Hacker Wire@TheHackerWire212d
Disclosure
🟠 CVE-2026-30920 - High OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installation_id values and updates ... https://www.thehackerwire.com/vulnerability/CVE-2026-30920/ https://t.co/CT2Y47U9OC
Post summary
The post announces the discovery of CVE-2026-30920 in OneUptime, describing a high‑severity flaw where the GitHub App callback trusts attacker‑controlled state and installation_id values; no PoC, exploit, patch or active‑use details are provided.
0000023
133 followersView on X
Infoflowcloud@infoflowcloud213d
Patch
🚨*CVE* CVE-2026-30920 OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installati… https://www.cve.org/CVERecord?id=CVE-2026-30920 ----- Traducción: CVE-2026-30920 One… http://infoflow.cloud`
Post summary
CVE-2026-30920 exposes a flaw where a OneUptime GitHub App callback trusts attacker‑controlled state, and the issue is remedied in version 10.0.19.
0000041
57 followersView on X
CVE@CVEnew213d
Patch
CVE-2026-30920 OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installati… https://www.cve.org/CVERecord?id=CVE-2026-30920
Post summary
The CVE describes a GitHub App callback issue in OneUptime that was fixed in version 10.0.19; technical details are limited and no exploitation or PoC is mentioned.
00000193
56.7K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash213d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-30920 - OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding Intel Report: https://ift.tt/Dm5XbR1
Post summary
The post announces CVE‑2026‑30920, highlighting broken access control in OneUptime’s GitHub App installation flow that permits unauthorized project binding, with no mention of patches, exploits, or PoC.
0000038
347 followersView on X
DailyCVE@dailycve213d
Disclosure
🔴 OneUptime, Broken Access Control, #CVE-2026-30920 (High) https://dailycve.com/oneuptime-broken-access-control-cve-2026-30920-high/
Post summary
The post announces a newly disclosed high‑severity CVE, CVE-2026-30920, describing it as a broken access control issue, but provides no PoC, exploit, or patch details.
0000022
166 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	hackerbay	oneuptime	-	-	-

Explore more

Back to dashboard hackerbay CVEs oneuptime vulnerabilities

What researchers are saying

CVE-2026-30920

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The CVE-2026-30920 vulnerability is an authorization bypass in OneUptime versions prior to 10.0.19 that permits project takeover; no PoC, exploit, or patch details are provided.

CVEFind.com@CveFindComPatch

OneUptime addressed CVE‑2026‑30920 by patching it in version 10.0.19, fixing a vulnerability that allowed overwriting GitHub App installation bindings; no active exploitation or PoC is mentioned.

The Hacker Wire@TheHackerWireDisclosure

The post announces the discovery of CVE-2026-30920 in OneUptime, describing a high‑severity flaw where the GitHub App callback trusts attacker‑controlled state and installation_id values; no PoC, exploit, patch or active‑use details are provided.

Infoflowcloud@infoflowcloudPatch

CVE-2026-30920 exposes a flaw where a OneUptime GitHub App callback trusts attacker‑controlled state, and the issue is remedied in version 10.0.19.

CVE@CVEnewPatch

The CVE describes a GitHub App callback issue in OneUptime that was fixed in version 10.0.19; technical details are limited and no exploitation or PoC is mentioned.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

The post announces CVE‑2026‑30920, highlighting broken access control in OneUptime’s GitHub App installation flow that permits unauthorized project binding, with no mention of patches, exploits, or PoC.

DailyCVE@dailycveDisclosure

The post announces a newly disclosed high‑severity CVE, CVE-2026-30920, describing it as a broken access control issue, but provides no PoC, exploit, or patch details.