Auth bypass in Openobserve
CVE-2024-55954
OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint `/api/{org_id}/users/{email_id}` allows an "Admin" role user to remove a "Root" user from the organization. This violates the intended pr…
Vulnerability class: Privilege Escalation
EPSS: 0.001 (30.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N.
Affected products
- Openobserve — versions < 0.14.1
Weakness classification (CWE)
References
- https://github.com/openobserve/openobserve/security/advisories/GHSA-m8gj-6r85-3r6m (x_refsource_CONFIRM)
- https://github.com/gaby/openobserve/blob/main/src/service/users.rs#L631 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-55954?
- CVE-2024-55954 is a high-severity vulnerability in Openobserve, classified under Improper Privilege Management. CVSS score: 8.7/10. Published 2025-01-16.
- How severe is CVE-2024-55954?
- High severity. CVSS v3 base score is 8.7 out of 10.