Read the docs
TI-2024-36995 Aliases CVE-2024-55954

OpenObserve Improper Authorization Allows Admin User to Remove Root User

Priority HIGH 73CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation, Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269 and CWE-284.

Summary

OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint `/api/{org_id}/users/{email_id}` allows an "Admin" role user to remove a "Root" user from the organization. This violates the intended privilege hierarchy, enabling a non-root user to remove the highest-privileged account. Due to insufficient role checks, the `remove_user_from_org` function does not prevent an "Admin" user from removing a "Root" user. As a result, an attacker with an "Admin" role can remove critical "Root" users, potentially gaining effective full control by eliminating the highest-privileged accounts. The `DELETE /api/{org_id}/users/{email_id}` endpoint is affected. This issue has been addressed in release version `0.14.1` and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00512 43rd percentileScored 2026-11-07
Fix Fixed openobserve (openobserve): 0.14.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openobserveopenobservebefore 0.14.10.14.1Patch availableCNA
  • openobserve Vendoropenobserve Affected before 0.14.1 Fixed in 0.14.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:openobserve:openobserve:*:*:*:*:*:*:*:*——openobserve
  • cpe:2.3:a:openobserve:openobserve:*:*:*:*:*:*:*:* Versions — — ·openobserve

Remediation

  • Fix · CNA openobserve (openobserve) Fixed in 0.14.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-55954

References

Other 2

  • TI-2024-16347 OpenObserve Privilege Escalation Vulnerability in Users API CVSS 3.1CRITICAL 10.0
  • TI-2024-27852 OpenObserve stored XSS vulnerability may lead to complete account takeover CVSS 3.1HIGH 8.8
  • TI-2025-40725 OpenObserve's Invite Token Lifecycle Misconfiguration CVSS 4.0HIGH 8.4
  • TI-2026-28348 OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url CVSS 3.1HIGH 7.7
  • TI-2025-40082 OpenObserve Vulnerable to HTML Injection in Organization Invitation Emails CVSS 3.1LOW 3.5
  • TI-2024-16561 OpenObserve Unauthorized Access Vulnerability in Users API CVSS 3.1CRITICAL 9.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences