Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-30920 is a broken access control vulnerability in the GitHub App installation flow of the OneUptime project versions prior to 10.0.19.'}, {'type': 'paragraph', 'content': "The vulnerability occurs because the GitHub App callback endpoint trusts attacker-controlled, unsigned base64-encoded JSON values in the 'state' and 'installation_id' parameters without proper validation or authorization."}, {'type': 'paragraph', 'content': "Specifically, the callback decodes the 'state' parameter containing 'projectId' and 'userId' without verifying authenticity or binding it to a session, allowing an attacker to supply arbitrary values."}, {'type': 'paragraph', 'content': "This enables an attacker to update the Project.gitHubAppInstallationId field with root privileges for any project, effectively overwriting another project's GitHub App installation binding."}, {'type': 'paragraph', 'content': 'Additionally, related GitHub API endpoints lack effective authorization, allowing repository enumeration and creation of CodeRepository records in arbitrary projects using a valid installation ID.'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized modification of project GitHub App bindings, allowing attackers to overwrite installation IDs with root privileges.

Attackers can cause temporary disruption of GitHub integrations by changing installation bindings.

It also enables cross-project binding of attacker-controlled installations, disclosure of repository metadata, and unauthorized creation of code repository records.

Because the attack requires no privileges or user interaction and has low complexity, it poses a high risk to affected systems.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for unusual or unauthorized GitHub App callback requests that include attacker-controlled, unsigned base64-encoded JSON values in the `state` and `installation_id` parameters. Specifically, look for callback requests where the `state` parameter contains arbitrary `projectId` and `userId` values without proper validation.'}, {'type': 'paragraph', 'content': 'Detection commands could include inspecting web server logs or API gateway logs for suspicious callback requests to the GitHub App callback endpoint that contain base64-encoded `state` parameters. Decoding these parameters and verifying their authenticity can help identify exploitation attempts.'}, {'type': 'list_item', 'content': 'Use command-line tools like `grep` or `jq` to extract and decode the `state` parameter from logs, for example:'}, {'type': 'list_item', 'content': "grep 'callback' /var/log/oneuptime/access.log | grep 'state=' | cut -d'=' -f2 | base64 --decode | jq '.'"}, {'type': 'list_item', 'content': 'Monitor for unexpected updates to `Project.gitHubAppInstallationId` fields with `isRoot: true` in your database or application logs.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the OneUptime package to version 10.0.19 or later, where this vulnerability has been fixed.

Additionally, review and restrict access to the GitHub App callback endpoints to ensure proper authorization checks are in place, and validate all incoming `state` and `installation_id` parameters to confirm they are authentic and authorized for the target project.

Monitor your projects for any unauthorized changes to GitHub App installation bindings and revoke any suspicious installation tokens.

Useful 0 Not Useful 0