{"action":"Upgrade @oneuptime/common to 10.0.19 or later.","affected":[{"fixed":"10.0.19","introduced":"0"}],"component":"@oneuptime/common","cve_ids":["CVE-2026-30920"],"ecosystem":"npm","epss":0.00216,"exploited":false,"fixed_versions":["10.0.19"],"ghsa_id":"GHSA-656w-6f6c-m9r6","id":"tcs_01M5KF5PP4GNQHZWMGC3VK78YW","modified_at":"2026-03-10T18:48:57.703665Z","published_at":"2026-03-09T17:29:47Z","references":["https://osv.dev/vulnerability/GHSA-656w-6f6c-m9r6","https://github.com/OneUptime/oneuptime/security/advisories/GHSA-656w-6f6c-m9r6","https://nvd.nist.gov/vuln/detail/CVE-2026-30920","https://github.com/OneUptime/oneuptime","https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L127-L165","https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L179-L258","https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L260-L356","https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L34-L112","https://github.com/OneUptime/oneuptime/blob/master/Common/Server/API/GitHubAPI.ts#L73-L79","https://github.com/OneUptime/oneuptime/blob/master/Common/Server/Middleware/UserAuthorization.ts#L205-L211","https://github.com/OneUptime/oneuptime/blob/master/Common/Server/Utils/CodeRepository/GitHub/GitHub.ts#L347-L425"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-656w-6f6c-m9r6","url":"https://osv.dev/vulnerability/GHSA-656w-6f6c-m9r6"}],"summary":"OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding"}