5 matches found
CVE-2024-24830
CVE-2024-24830 affects OpenObserve. The vulnerability lies in the "/api/{org_id}/users" endpoint, where the payload allows an authenticated regular user (member) to create new users with elevated privileges, including the root role. The root cause is that the user creation process does not valida...
CVE-2024-25106
OpenObserve CVE-2024-25106 affects OpenObserve versions prior to 0.8.0. The issue is an Authorization flaw in the remove_user_from_org flow exposed at /api/{org_id}/users/{email_id}, allowing any authenticated organizational member to remove any other member (including Admin/Root), due to insuffi...
CVE-2024-41809
CVE-2024-41809 OpenObserve XSS : The OpenObserve platform contains a cross-site scripting vulnerability in the file openobserve/web/src/views/MemberSubscription.vue (line 32) present in versions before 0.10.0. The issue is fixed in 0.10.0, which sanitizes incoming HTML. Several connected sources ...
CVE-2024-41808
CVE-2024-41808 concerns the OpenObserve open‑source observability platform. Multiple connected sources confirm that versions through 0.9.1 do not sufficiently sanitize user input in the log filter selection menu, creating a path to a full account takeover when combined with insecure frontend auth...