OneUptime allowed unverified GitHub App callback parameters to reset a project’s GitHubAppInstallationId and set isRoot to true, creating an unauthorized root relationship with that project. This flaw also permits an attacker to enumerate repositories and create CodeRepository records for arbitrary projects using valid installation IDs. The weakness is rooted in improper access control and environment validation—CWE-345, CWE-639, and CWE-862—leading to potential compromise of project integrity and confidentiality.

The vulnerability affects OneUptime across all versions prior to 10.0.19. No specific sub‑product or third‑party component is mentioned; the primary product is the OneUptime monitoring platform.

With a CVSS base score of 8.6, the vulnerability is high severity, yet the EPSS score of less than 1% indicates a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalogue. An attacker would need to craft or obtain a malicious GitHub App installation callback that supplies attacker‑controlled state and installation_id values, a scenario that is plausible but not trivial without access to a GitHub App environment. The lack of effective authorization on related GitHub endpoints further expands the surface for enumeration and data insertion once the initial binding bypass is achieved.