Improper Privilege Management

org.apache.streampipes, streampipes-parent is vulnerable to improper privilege management. The vulnerability is due to missing or improper access control checks in the REST interface, allowing unauthorized access to resources when the resource ID is known...

Apache StreamPipes elevation of privilege vulnerability (CNVD-2025-05698)

Apache StreamPipes is an open source self-service industrial IoT toolkit that enables users to connect, analyze and explore IIoT data streams. A security vulnerability exists in Apache StreamPipes version 0.95.1 and earlier, which stems from a lack of filtering and sloppy validation of resource...

CVE-2024-24778

Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affects Apache StreamPipes: through 0.95.1. Users are recommended to upgrade to version 0.97.0 which fixes the issue...

GHSA-VM7W-2724-5M23 Apache StreamPipes has improper privilege management in a REST interface

Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was known. This issue affects Apache StreamPipes: through 0.95.1. Users are recommended to upgrade to version 0.97.0 which fixes the issue...

Apache StreamPipes has improper privilege management in a REST interface

Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was known. This issue affects Apache StreamPipes: through 0.95.1. Users are recommended to upgrade to version 0.97.0 which fixes the issue...

org.apache.streampipes:streampipes-backend (>=0.66.0 <=0.90.0), org.apache.streampipes:streampipes-platform-services (>=0.68.0 <=0.95.1) +2 more potentially affected by CVE-2024-24778 via org.apache.streampipes:streampipes-rest (>=0.66.0 <=0.95.1)

org.apache.streampipes:streampipes-rest MAVEN version =0.66.0, =0.66.0, =0.68.0, =0.91.0, =0.93.0, =0.95.0 Source cves: CVE-2024-24778 Source advisory: SNYK:JAVA-ORGAPACHESTREAMPIPES-9058044...

PYSEC-2025-66

Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affects Apache StreamPipes: through 0.95.1. Users are recommended to upgrade to version 0.97.0 which fixes the issue...

CVE-2024-24778

Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affects Apache StreamPipes: through 0.95.1. Users are recommended to upgrade to version 0.97.0 which fixes the issue...

PYSEC-2025-66

Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affects Apache StreamPipes: through 0.95.1.Users are recommended to upgrade to version 0.97.0 which fixes the issue...

CVE-2024-24778 Apache StreamPipes: Resources Permission Escalation

Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affects Apache StreamPipes: through 0.95.1. Users are recommended to upgrade to version 0.97.0 which fixes the issue...

CVE-2024-24778

CVE-2024-24778 – Apache StreamPipes" : Applies to StreamPipes up to version 0.95.1. Root cause described across sources as improper privilege management in a REST interface, due to lack of filtering/sloppy validation of resource IDs, allowing registered users to access unauthorized resources if t...

CVE-2024-24778 Apache StreamPipes: Resources Permission Escalation

Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affects Apache StreamPipes: through 0.95.1. Users are recommended to upgrade to version 0.97.0 which fixes the issue...

CVE-2024-24778 Apache StreamPipes: Resources Permission Escalation

Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. This issue affects Apache StreamPipes: through 0.95.1. Users are recommended to upgrade to version 0.97.0 which fixes the issue...

PT-2025-9316 · Apache · Apache Streampipes

Name of the Vulnerable Software and Affected Versions: Apache StreamPipes versions through 0.95.1 Description: The issue is related to improper privilege management in a REST interface, allowing registered users to access unauthorized resources if the resource ID is known. Recommendations: Upgrad...

Apache StreamPipes 安全漏洞

Apache StreamPipes is an open source self-service industrial IoT toolkit that enables users to connect, analyze and explore IIoT data streams. A security vulnerability exists in Apache StreamPipes version 0.95.1 and earlier, which stems from a lack of filtering and sloppy validation of resource...

The vulnerability of the Self-Registration component in the IoT Apache StreamPipes toolset allows a attacker to disrupt the user management process of StreamPipes.

The vulnerability of the Self-Registration component in the IoT Apache StreamPipes toolkit is related to synchronization errors when using a common resource. This vulnerability can allow a malicious actor to manipulate the StreamPipes user management process by creating multiple users with the sa...

Remote Code Execution (RCE)

Apache StreamPipes is vulnerable to Remote Code Execution RCE. The vulnerability is due to the lack of restrictions on the types of files that authenticated and authorized users can upload, which allows an attacker to execute malicious code on the server...

Server-side Request Forgery (SSRF)

org.apache.streampipes: streampipes-rest is vulnerable to Server-side Request Forgery SSRF. The vulnerability is due to improper validation of custom endpoints during the installation process of a pipeline elements, allowing an attacker to manipulate StreamPipes into sending HTTP GET requests to...

Time-of-check Time-of-use (TOCTOU) Race Condition

Apache streampipes is vulnerable to Time-of-check Time-of-use TOCTOU Race Condition. The vulnerability arises from insufficient synchronization during user registration, allowing multiple simultaneous requests to check and register a user using the same email address. Attackers exploit this by...

Apache StreamPipes has potential remote code execution (RCE) via file upload

Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes. Such a dangerous type might be an executable file that may lead to a remote code execution RCE. The unrestricted upload is only possible for authenticated and authorized users. This issue affects Apache...