OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters… (CVE-2026-112047)

CVE-2026-112047 describes an incorrect authorization vulnerability in OneUptime versions >=14.0.2 and <14.0.69. Authenticated project members can exploit flawed project-wide permission checks to act on clusters outside their intended scope. The vulnerability affects several features such as AI access test, agent reset, kubectl plan approval, and incident AI conversation, allowing attackers to learn agent RBAC permissions, disconnect agents, approve unauthorized kubectl changes, or run commands on unauthorized resources.

The vulnerability allows authenticated users with project membership to escalate their privileges and perform unauthorized actions on clusters outside their assigned scope. This can lead to unauthorized access to cluster resources, manipulation of cluster agents, and execution of commands on resources they should not control. The CVSS score of 5.4 (medium severity) reflects limited confidentiality and integrity impact with no availability impact.

A fix is available in OneUptime version 14.0.69 and later. Users should upgrade to version 14.0.69 or above to remediate this authorization vulnerability. No additional mitigation is indicated by the vendor advisory.