{"action":"Upgrade @oneuptime/common to 10.0.21 or later.","affected":[{"fixed":"10.0.21","introduced":"0"}],"component":"@oneuptime/common","cve_ids":["CVE-2026-30956"],"ecosystem":"npm","epss":0.00503,"exploited":false,"fixed_versions":["10.0.21"],"ghsa_id":"GHSA-r5v6-2599-9g3m","id":"tcs_01M5KG83RMK0482V7G4WRW3QPR","modified_at":"2026-03-10T19:03:36.459976Z","published_at":"2026-03-10T01:09:40Z","references":["https://osv.dev/vulnerability/GHSA-r5v6-2599-9g3m","https://github.com/OneUptime/oneuptime/security/advisories/GHSA-r5v6-2599-9g3m","https://nvd.nist.gov/vuln/detail/CVE-2026-30956","https://github.com/OneUptime/oneuptime","https://github.com/OneUptime/oneuptime/releases/tag/10.0.21"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-r5v6-2599-9g3m","url":"https://osv.dev/vulnerability/GHSA-r5v6-2599-9g3m"}],"summary":"OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account takeover"}