CVE-2026-30920

npm/@oneuptime/common CVE-2026-30920: high 8.6

OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding

Action: Upgrade @oneuptime/common to 10.0.19 or later.

npm i @oneuptime/common@10.0.19

Affected

Fixed versions

Sources

• osv: GHSA-656w-6f6c-m9r6
• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-656w-6f6c-m9r6
• https://nvd.nist.gov/vuln/detail/CVE-2026-30920
• https://github.com/OneUptime/oneuptime
• https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L127-L165
• https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L179-L258
• https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L260-L356
• https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L34-L112
• https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L73-L79
• https://github.com/OneUptime/oneuptime/blob/master/Common/Server/Middleware/UserAuthorization.ts#L205-L211
• https://github.com/OneUptime/oneuptime/blob/master/Common/Server/Utils/CodeRepository/GitHub/GitHub.ts#L347-L425

CVE-2026-30920 · published 2026-03-09T17:29:47Z · modified 2026-03-10T18:48:57.703665Z · JSON