Is CVE-2026-30956 actively exploited?

CVE-2026-30956 has no public evidence of in-the-wild exploitation as of 2026-03-11.

What is the CVSS score for CVE-2026-30956?

CVE-2026-30956 has a CVSS score of 9.9 (CRITICAL severity). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

How do I patch CVE-2026-30956?

Vendor patch guidance is linked from the references on this page. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2026-30956.

Which products are affected by CVE-2026-30956?

Affected products for CVE-2026-30956 are listed on this page once vendor data becomes available.

Fix CVE-2026-30956 - CRITICAL Vulnerability

Description

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 and earlier by sending a forged is-multi-tenant-query header together with a controlled projectid header. Because the server trusts this client-supplied header, internal permission checks in BasePermission are skipped and tenant scoping is disabled. This allows attackers to access project data belonging to other tenants, read sensitive User fields via nested relations, leak plaintext resetPasswordToken, and reset the victim’s password and fully take over the account. This results in cross‑tenant data exposure and full account takeover. This vulnerability is fixed in 10.0.21.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector: network
Complexity: low
Privileges: low
User Action: none
Scope: changed
Confidentiality: high
Integrity: high
Availability: high
Weaknesses: CWE-285 CWE-862 · Missing Authorization

Metadata

Primary Vendor: UNKNOWN
Published: 3/10/2026
Last Modified: 3/11/2026
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

No affected products information available.

Remediation Guidance

Executive Summary

Cite this page

CVE-2026-30956. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2026-30956

View on NIST NVD

CVE-2026-30956 vulnerability