PT-2025-3162 · Unknown · Openobserve
Gaby
·
Published
2025-01-16
·
Updated
2025-01-17
·
CVE-2024-55954
CVSS v3.1
8.7
High
| Vector | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
OpenObserve versions prior to 0.14.1
Description
A vulnerability in the user management endpoint
/api/{org id}/users/{email id} allows an "Admin" role user to remove a "Root" user from the organization, violating the intended privilege hierarchy. This is due to insufficient role checks in the remove user from org function, enabling a non-root user to remove the highest-privileged account. As a result, an attacker with an "Admin" role can remove critical "Root" users, potentially gaining effective full control by eliminating the highest-privileged accounts. The DELETE /api/{org id}/users/{email id} endpoint is affected.Recommendations
For OpenObserve versions prior to 0.14.1, upgrade to release version 0.14.1 to address the issue. As a temporary workaround, consider restricting access to the
remove user from org function or the /api/{org id}/users/{email id} endpoint to prevent "Admin" users from removing "Root" users until the upgrade is applied.Exploit
Fix
Improper Privilege Management
Improper Authorization
Improper Access Control
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Openobserve