OpenObserve is a observability platform built specifically for logs, metrics, traces, analytics, designed to work at petabyte scale. A critical vulnerability has been identified in the "/api/{org_id}/users/{email_id}" endpoint. This vulnerability allows any authenticated user within an organization to remove any other user from that same organization, irrespective of their respective roles. This includes the ability to remove users with "Admin" and "Root" roles. By enabling any organizational member to unilaterally alter the user base, it opens the door to unauthorized access and can cause considerable disruptions in operations. The core of the vulnerability lies in the `remove_user_from_org` function in the user management system. This function is designed to allow organizational users to remove members from their organization. The function does not check if the user initiating the request has the appropriate administrative privileges to remove a user. Any user who is part of the organization, irrespective of their role, can remove any other user, including those with higher privileges. This vulnerability is categorized as an Authorization issue leading to Unauthorized User Removal. The impact is severe, as it compromises the integrity of user management within organizations. By exploiting this vulnerability, any user within an organization, without the need for administrative privileges, can remove critical users, including "Admins" and "Root" users. This could result in unauthorized system access, administrative lockout, or operational disruptions. Given that user accounts are typically created by "Admins" or "Root" users, this vulnerability can be exploited by any user who has been granted access to an organization, thereby posing a critical risk to the security and operational stability of the application. This issue has been addressed in release version 0.8.0. Users are advised to upgrade.
The vulnerability exists in the `remove_user_from_org` function handling the endpoint `/api/{org_id}/users/{email_id}`. This function does not verify whether the user initiating the request has the administrative privileges necessary to remove another organization member. As a result, any authenticated user belonging to the organization — regardless of assigned role — can send a request to remove any other user, including those with Admin and Root roles. The lack of authorization check in this function is the core of the described vulnerability.
An attacker with an account in the organization can cause administrative lockout by blocking access to administrators and Root users, unauthorized takeover of organization control, or serious operational disruptions through selective removal of critical user accounts.
Update OpenObserve to version 0.8.0 or later, in which the issue has been resolved. Users are strongly encouraged to perform the update immediately.
OpenObserve in all versions prior to 0.8.0
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:LOpenobserve
APPOpenobserve< 0.8.0
Related vulnerabilities
OpenObserve: privilege escalation przez endpoint dodawania użytkowników
OpenObserve is a cloud-native observability platform. In 0.70.3 and earlier, the validate_enrichment_url funct...
The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the v...
OpenObserve is an open-source observability platform. Starting in version 0.4.4 and prior to version 0.10.0, O...