TI-2024-14983 Aliases CVE-2024-22409

Default Privileges allow for high level operations for low privileged users in datahub

HIGH 73CWE-276Published 2024-01-16 · Updated 2025-06-17

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

DataHub is an open-source metadata platform. In affected versions a low privileged user could remove a user, edit group members, or edit another user's profile information. The default privileges gave too many broad permissions to low privileged users. These have been constrained in PR #9067 to prevent abuse. This issue can result in privilege escalation for lower privileged users up to admin privileges, potentially, if a group with admin privileges exists. May not impact instances that have modified default privileges. This issue has been addressed in datahub version 0.12.1. Users are advised to upgrade.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00652 51st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed datahub (datahub-project): 0.12.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
datahub-project	datahub	before 0.12.1	0.12.1	Patch available	CNA

datahub Vendordatahub-project Affected before 0.12.1 Fixed in 0.12.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:datahub_project:datahub::::::::	before 0.12.1	Vulnerable	datahub-project

cpe:2.3:a:datahub_project:datahub:*:*:*:*:*:*:*:* Versions before 0.12.1 Vulnerable ·datahub-project

Remediation

Fix · CNA datahub (datahub-project) Fixed in 0.12.1

Timeline

2026-10-02 Threatist record created from CVE-2024-22409
2026-10-14 EPSS moved to the 50th–90th percentile

References

Exploit 1

https://github.com/datahub-project/datahub/security/advisories/GHSA-x3v6-r479-m4xv

Patch 1

https://github.com/datahub-project/datahub/pull/9067

TI-2023-25771 Privilege escalation through email sign-up in datahub CVSS 3.1HIGH 8.0
TI-2023-25770 Session Expiration Misconfiguration in datahub CVSS 3.1MEDIUM 4.8
TI-2023-10861 Deserialization of untrusted data in DataHub CVSS 3.1HIGH 8.8
TI-2023-25780 Insecure Use of HMAC-SHA1 For Session Signing in datahub CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences