icon

We found results for “

CVE-2024-55954

Date: January 16, 2025

OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint "/api/{org_id}/users/{email_id}" allows an "Admin" role user to remove a "Root" user from the organization. This violates the intended privilege hierarchy, enabling a non-root user to remove the highest-privileged account. Due to insufficient role checks, the "remove_user_from_org" function does not prevent an "Admin" user from removing a "Root" user. As a result, an attacker with an "Admin" role can remove critical "Root" users, potentially gaining effective full control by eliminating the highest-privileged accounts. The "DELETE /api/{org_id}/users/{email_id}" endpoint is affected. This issue has been addressed in release version "0.14.1" and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity Score

Severity Score

Weakness Type (CWE)

Improper Authentication

CWE-287

Improper Access Control

CWE-284

Improper Authorization

CWE-285

Improper Privilege Management

CWE-269

Least Privilege Violation

CWE-272

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): HIGH
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us