A critical authorization bypass vulnerability in OneUptime allows unauthenticated attackers to manipulate GitHub App installation bindings and gain unauthorized access to project repository data.

The application fails to validate the authorization of callers during the GitHub App callback process, allowing an unauthenticated attacker to inject controlled state and installation IDs. This results in the elevation of privileges, enabling the attacker to overwrite project bindings and enumerate sensitive repository information.

The exploitation of this vulnerability leads to significant security risks, including unauthorized access to internal project data and the potential for supply chain compromise through the manipulation of repository records. Given the CVSS score of 8.6, this flaw presents a high risk to organizational confidentiality and integrity, as it allows attackers to bypass core access controls without requiring prior authentication.

Immediate Action: Update the OneUptime instance to version 10.0.19 or later immediately to incorporate the necessary authorization checks.

Proactive Monitoring: Review audit logs for suspicious GitHub App callback activities or unexpected modifications to Project GitHub App installation bindings.

Compensating Controls: Implement strict network access controls to limit access to the OneUptime web interface and utilize a Web Application Firewall to block suspicious callback requests targeting the vulnerable endpoints.

Public Exploit Available: Unknown.

Due to the high severity of this authorization bypass and the potential for unauthorized access to project repositories, organizations must prioritize upgrading to version 10.0.19. Failure to patch this vulnerability leaves the environment exposed to unauthorized configuration changes and data enumeration by any remote attacker.