CVE-2024-55954

OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint `/api/{org_id}/users/{email_id}` allows an "Admin" role user to remove a "Root" user from the organization. This violates the intended privilege hierarchy, enabling a non-root user to remove the highest-privileged account. Due to insufficient role checks, the `remove_user_from_org` function does not prevent an "Admin" user from removing a "Root" user. As a result, an attacker with an "Admin" role can remove critical "Root" users, potentially gaining effective full control by eliminating the highest-privileged accounts. The `DELETE /api/{org_id}/users/{email_id}` endpoint is affected. This issue has been addressed in release version `0.14.1` and all users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-269
• CWE-272
• CWE-284
• CWE-285
• CWE-287

• https://github.com/gaby/openobserve/blob/main/src/service/users.rs#L631
• https://github.com/openobserve/openobserve/security/advisories/GHSA-m8gj-6r85-3r6m

Published

Jan 16, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-55949MinIO is a high-performance, S3 compatible object store, ope…9.3
• CVE-2024-5595The Essential Blocks WordPress plugin before 4.7.0 does not…5.4
• CVE-2024-55950Tabby (formerly Terminus) is a highly configurable terminal …8.6
• CVE-2024-55951Metabase is an open-source data analytics platform. For new …4.8
• CVE-2024-55952DataEase is an open source business analytics tool. Authenti…8.8
• CVE-2024-55953DataEase is an open source business analytics tool. Authenti…8.1
• CVE-2024-55955An incorrect permissions assignment vulnerability in Trend M…7.3
• CVE-2024-55956In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, a…9.8
• CVE-2024-55957In Thermo Fisher Scientific Xcalibur before 4.7 SP1 and Ther…7.8
• CVE-2024-55958Northern.tech CFEngine Enterprise Mission Portal 3.24.0, 3.2…4.8
• CVE-2024-55959Northern.tech Mender Client 4.x before 4.0.5 has Insecure Pe…9.1
• CVE-2024-5596The ARMember Premium plugin for WordPress is vulnerable to C…6.3