Unauthorized Privilege Escalation Vulnerability in OpenObserve

CVE-2024-24830

What is CVE-2024-24830?

A security flaw has been identified in OpenObserve's observability platform that impacts the '/api/{org_id}/users' endpoint. The vulnerability allows any authenticated regular user ('member') to create new users with elevated privileges, including the 'root' role, within their organization. This flaw exists in the user creation process, where the payload lacks proper validation of user roles, enabling regular users to alter the payload and assign unauthorized root-level privileges. The consequence of this vulnerability is a significant breach of the application's role-based access control system, granting unauthorized control over application resources and jeopardizing data security. All user types, especially those holding administrative positions, are affected. Users are strongly encouraged to upgrade to version 0.8.0 to mitigate this risk, as no alternative workarounds are available.

References