CVE-2024-41942

JupyterHub is software that allows one to create a multi-user server for
Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted
the admin:users scope, they may escalate their own privileges by making
themselves a full admin user. The impact is relatively small in that
admin:users is already an extremely privileged scope only granted to
trusted users.
In effect, admin:users is equivalent to admin=True, which is not
intended. Note that the change here only prevents escalation to the
built-in JupyterHub admin role that has unrestricted permissions. It does
not prevent users with e.g. groups permissions from granting themselves
or other users permissions via group membership, which is intentional.
Versions 4.1.6 and 5.1.0 fix this issue.