CVE-2024-24830

OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been identified in the "/api/orgid/users" endpoint. This vulnerability allows any authenticated regular user 'member' to add new users with...

CVE-2024-24830

CVE-2024-24830 affects OpenObserve. The vulnerability lies in the "/api/{org_id}/users" endpoint, where the payload allows an authenticated regular user (member) to create new users with elevated privileges, including the root role. The root cause is that the user creation process does not valida...

CVE-2024-24830 OpenObserve Privilege Escalation Vulnerability in Users API

OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been identified in the "/api/orgid/users" endpoint. This vulnerability allows any authenticated regular user 'member' to add new users with...

CVE-2024-24830 OpenObserve Privilege Escalation Vulnerability in Users API

OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been identified in the "/api/orgid/users" endpoint. This vulnerability allows any authenticated regular user 'member' to add new users with...

CVE-2024-24830 OpenObserve Privilege Escalation Vulnerability in Users API

OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been identified in the "/api/orgid/users" endpoint. This vulnerability allows any authenticated regular user 'member' to add new users with...

CVE-2024-25106 OpenObserve Unauthorized Access Vulnerability in Users API

OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/orgid/users/emailid" endpoint. This vulnerability allows any authenticated user within an organization to...

CVE-2024-25106

OpenObserve CVE-2024-25106 affects OpenObserve versions prior to 0.8.0. The issue is an Authorization flaw in the remove_user_from_org flow exposed at /api/{org_id}/users/{email_id}, allowing any authenticated organizational member to remove any other member (including Admin/Root), due to insuffi...

CVE-2024-25106 OpenObserve Unauthorized Access Vulnerability in Users API

OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/orgid/users/emailid" endpoint. This vulnerability allows any authenticated user within an organization to...

CVE-2024-25106

OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/orgid/users/emailid" endpoint. This vulnerability allows any authenticated user within an organization to...

CVE-2024-25106 OpenObserve Unauthorized Access Vulnerability in Users API

OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/orgid/users/emailid" endpoint. This vulnerability allows any authenticated user within an organization to...

CVE-2024-24830: Improper Privilege Management

OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been identified in the "/api/orgid/users" endpoint. This vulnerability allows any authenticated regular user 'member' to add new users with...

OpenObserve Security Vulnerability

OpenObserve is a cloud-native observability platform open-sourced by OpenObserve. A security vulnerability exists in OpenObserve versions prior to 0.8.0 that stems from an unauthorized access vulnerability in the User Api...

PT-2024-20597

Name of the Vulnerable Software and Affected Versions OpenObserve versions prior to 0.8.0 Description A vulnerability has been identified in the "/api/org id/users" endpoint, allowing any authenticated regular user to add new users with elevated privileges, including the 'root' role, to an...

PT-2024-3903

Name of the Vulnerable Software and Affected Versions: OpenObserve versions prior to 0.8.0 Description: A critical issue has been identified in the "/api/org id/users/email id" endpoint, allowing any authenticated user within an organization to remove any other user, including those with "Admin"...

OpenObserve Security Vulnerability

OpenObserve is a cloud-native observability platform open-sourced by OpenObserve. A security vulnerability exists in OpenObserve versions prior to 0.8.0 that stems from an elevation of privilege vulnerability in the User Api...

CVE-2024-25106: Improper Access Control

OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/orgid/users/emailid" endpoint. This vulnerability allows any authenticated user within an organization to...