CVE-2024-24830

OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A vulnerability has been identified in the "/api/{org_id}/users" endpoint. This vulnerability allows any authenticated regular user ('member') to add new users with elevated privileges, including the 'root' role, to an organization. This issue circumvents the intended security controls for role assignments. The vulnerability resides in the user creation process, where the payload does not validate the user roles. A regular user can manipulate the payload to assign root-level privileges. This vulnerability leads to Unauthorized Privilege Escalation and significantly compromises the application's role-based access control system. It allows unauthorized control over application resources and poses a risk to data security. All users, particularly those in administrative roles, are impacted. This issue has been addressed in release version 0.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-269
• CWE-272
• CWE-284
• CWE-285
• CWE-287

• https://github.com/openobserve/openobserve/security/advisories/GHSA-hfxx-g56f-8h5vExploit, Third Party Advisory
• https://github.com/openobserve/openobserve/security/advisories/GHSA-hfxx-g56f-8h5vExploit, Third Party Advisory

Published

Feb 8, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-24825DIRAC is a distributed resource framework. In affected versi…7.5
• CVE-2024-24826Exiv2 is a command-line utility and C++ library for reading,…5
• CVE-2024-24827Discourse is an open source platform for community discussio…7.5
• CVE-2024-24828pkg is tool design to bundle Node.js projects into an execut…7.8
• CVE-2024-24829Sentry is an error tracking and performance monitoring platf…5.3
• CVE-2024-2483A vulnerability, which was classified as problematic, has be…4.3
• CVE-2024-24831Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2024-24832Missing Authorization vulnerability in Metagauss EventPrime.…7.5
• CVE-2024-24833Missing Authorization vulnerability in HappyMonster Happy Ad…8.8
• CVE-2024-24834Improper Neutralization of Input During Web Page Generation …4.8
• CVE-2024-24835Missing Authorization vulnerability in realmag777 BEAR.This …6.5
• CVE-2024-24836Improper Neutralization of Input During Web Page Generation …5.4