GHSA-r5v6-2599-9g3m OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account takeover
SummaryA low‑privileged user can bypass authorization and tenant isolation in OneUptime `v10.0.20` by sending a forged `is-multi-tenant-query` header together with a controlled `projectid` header.Because the server trusts this client-supplied header, internal permission checks in `BasePermission` are skipped and tenant scoping is disabled.This allows attackers to:Access project data belonging to other tenantsRead sensitive User fields via nested relationsLeak plaintext resetPasswordTokenReset the victim’s password and fully take over the accountThis results in cross‑tenant data exposure and full account takeover.DetailsRoot causeThe API trusts a client‑controlled header to determine whether a request should bypass authorization checks.CommonAPI.tsBasePermission.tsWhen the attacker sends:the system skips all authorization checks including:Table permission validationQuery permission validationSelect permission validationTenant isolation enforcementAdditionally, tenant scoping is disabled in `TenantPermission`Sensitive user data exposureProjects marked with:allow cross-tenant queries when the header is present.The Project model contains a relation:Because select permission checks are skipped, attackers can retrieve sensitive fields from the User model including:Reset token stored in plaintextIn the password reset flow:Authentication.tsThe reset token is stored in plaintext in the database.During password reset:the server validates the provided token directly.If an attacker leaks this token through the authorization bypass, they can immediately reset the victim’s password.Exploitation chainAttacker bypasses tenant isolation using is-multi-tenant-queryAttacker reads victim projectAttacker selects createdByUser.resetPasswordTokenAttacker triggers forgot-password for victimAttacker retrieves the fresh token via the same queryAttacker calls /api/identity/reset-passwordAttacker sets a new passwordAttacker logs in as victimThis results in full account takeover.PoC**Setup:**Local OneUptime v10.0.20 instanceTwo normal accounts:Attacker account owns Project A (`7cb77c45-c2e0-42b5-8a28-57aa0dec6e82`)Victim account owns Project B (`88ced36b-4c0a-4c12-bdf1-497d60b10b23`) with email `victim@example.com`Chain 1: Direct Project Isolation Bypass**1. Read isolation bypass**Result: Returns both the attacker's and victim's projects:Write isolation bypassVictim project name is initially: Victim Project ORIGINALResult: Victim project name is updated to "Victim Project EXPLOIT" despite the attacker not being a member of the victim project.Chain 2: Account Takeover via Credential LeakageTrigger password reset for victimLeak victim password hash and reset token via tenant bypassResult: Sensitive user data is exposed:Take over victim account using leaked tokenResult: Successful login with attacker-chosen password, original password fails - complete account takeover achieved.Result: Victim project name is updated despite the attacker not being a member of the victim project.ImpactThis vulnerability allows a low‑privileged authenticated user to:bypass tenant isolationaccess other tenant projectsread sensitive user credential fieldsleak plaintext reset tokensreset victim passwordsfully take over victim accountsBecause OneUptime is a multi‑tenant monitoring platform, this allows attackers to compromise any tenant account in the system.
CVSS v3.1 score: 9.9