Is CVE-2026-30920 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-30920 being exploited in the wild.

How severe is CVE-2026-30920?

Low severity, with a CVSS score of 3.1, published 9 March 2026.

Which products and versions are affected?

@oneuptime/common (npm) SEMVER:introduced=0,fixed=10.0.19; OneUptime < 10.0.19.

Is there a fix for CVE-2026-30920?

Yes. @oneuptime/common (npm): upgrade to 10.0.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-30920 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-30920?

Check whether you run @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30920: OneUptime broken access control in GitHub App installation flow

Q: Is there a fix for CVE-2026-30920?

Yes. @oneuptime/common (npm): upgrade to 10.0.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-30920 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-30920?

Check whether you run @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30920 · Severity: low · CVSS 3.1 · Published 2026-03-09

OneUptime is an incident management and monitoring platform that integrates with GitHub for code repository tracking. A flaw in its GitHub App authorization flow allows attackers to hijack another organization's GitHub integration without authentication, potentially exposing repository metadata and allowing unauthorized creation of code repository records. This could lead to data exposure, service disruption, or further compromise of integrated development workflows.

Technologies: @oneuptime/common (npm), OneUptime. Vendors: npm, OneUptime.

Quick answers

Is CVE-2026-30920 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-30920 being exploited in the wild.
How severe is CVE-2026-30920?: Low severity, with a CVSS score of 3.1, published 9 March 2026.
Which products and versions are affected?: @oneuptime/common (npm) SEMVER:introduced=0,fixed=10.0.19; OneUptime < 10.0.19.
Is there a fix for CVE-2026-30920?: Yes. @oneuptime/common (npm): upgrade to 10.0.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-30920 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-30920?: Check whether you run @oneuptime/common (npm) or OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@oneuptime/common (npm): upgrade to 10.0.19 or later
```
npm install @oneuptime/common@10.0.19
```

Technical details

OneUptime's GitHub App callback handler trusts attacker-controlled base64-encoded JSON (state parameter) and installation_id values without proper validation. The vulnerable code decodes the unsigned state, extracts the projectId directly, and updates the target project's gitHubAppInstallationId with root privileges without verifying the caller's authorization. Additionally, the userId field is only checked for presence, not authenticity. Related endpoints for repository listing and connection also lack effective authorization checks, and the middleware permits unauthenticated requests to proceed as "Public" users. An attacker can craft a malicious callback URL with an arbitrary victim's project UUID to overwrite their GitHub installation binding, or use a valid installation ID to enumerate repositories and create CodeRepository records in any project. The vulnerability requires only network access and no authentication (CVSS 3.1/AV:N/AC:L/PR:N/UI:N). Version 10.0.19 contains a fix.

Affected products

OneUptime OneUptime < 10.0.19

Identifiers

CVE-2026-30920
GHSA-656w-6f6c-m9r6

Timeline

2026-03-09: disclosed

References

https://github.com/OneUptime/oneuptime/security/advisories/GHSA-656w-6f6c-m9r6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.