Access Control Flaw in OpenObserve by OpenObserve

CVE-2025-66223

What is CVE-2025-66223?

OpenObserve, a cloud-native observability platform, has a flaw in its management of organization invitation tokens prior to version 0.16.0. These tokens do not expire after issuance, remaining valid even after a user is removed from the organization. This vulnerability allows for multiple invitations to be sent to the same email address with different roles, meaning that users who have been removed or demoted can still access the system or escalate their privileges. The issue has been remediated in version 0.16.0.

References