Executive brief
OneUptime is an incident management and monitoring platform that integrates with GitHub for code repository tracking. A flaw in its GitHub App authorization flow allows attackers to hijack another organization's GitHub integration without authentication, potentially exposing repository metadata and allowing unauthorized creation of code repository records. This could lead to data exposure, service disruption, or further compromise of integrated development workflows.
Technical details
OneUptime's GitHub App callback handler trusts attacker-controlled base64-encoded JSON (state parameter) and installation_id values without proper validation. The vulnerable code decodes the unsigned state, extracts the projectId directly, and updates the target project's gitHubAppInstallationId with root privileges without verifying the caller's authorization. Additionally, the userId field is only checked for presence, not authenticity. Related endpoints for repository listing and connection also lack effective authorization checks, and the middleware permits unauthenticated requests to proceed as "Public" users. An attacker can craft a malicious callback URL with an arbitrary victim's project UUID to overwrite their GitHub installation binding, or use a valid installation ID to enumerate repositories and create CodeRepository records in any project. The vulnerability requires only network access and no authentication (CVSS 3.1/AV:N/AC:L/PR:N/UI:N). Version 10.0.19 contains a fix.
Affected products
- OneUptime OneUptime < 10.0.19
Timeline
- 2026-03-09: disclosed