CVE-2026-30956 - Vulnerability Analysis

Overview

OneUptime <= 10.0.20 contains a broken access control vulnerability caused by trusting client-supplied is-multi-tenant-query header, letting low-privileged users bypass authorization and tenant isolation to access other tenants' data and take over accounts, exploit requires sending forged headers.

Severity & Score

Impact

Attackers can access other tenants' data, read sensitive user information, and fully take over accounts, leading to data exposure and account compromise.

Mitigation

Upgrade to version 10.0.21 or later.

References

• https://github.com/OneUptime/oneuptime/releases/tag/10.0.21
• https://github.com/OneUptime/oneuptime/security/advisories/GHSA-r5v6-2599-9g3m

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 10, 2026

🔴 CVE-2026-30956 - Critical (9.9) OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 and earlier by sending a forged is-multi-tenant-query header togethe... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-30956/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner