Read the docs
TI-2025-40725 Aliases CVE-2025-66223

OpenObserve's Invite Token Lifecycle Misconfiguration

Priority HIGH 72CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remain valid even after the invited user is removed from the organization, and allow multiple invitations to the same email with different roles where all issued links remain valid simultaneously. This results in broken access control where a removed or demoted user can regain access or escalate privileges. This issue has been patched in version 0.16.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00292 21st percentileScored 2026-11-07
Fix Fixed openobserve (openobserve): 0.16.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openobserveopenobservebefore 0.16.00.16.0Patch availableCNA
  • openobserve Vendoropenobserve Affected before 0.16.0 Fixed in 0.16.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:openobserve:openobserve:*:*:*:*:*:*:*:*——openobserve
  • cpe:2.3:a:openobserve:openobserve:*:*:*:*:*:*:*:* Versions — — ·openobserve

Remediation

  • Fix · CNA openobserve (openobserve) Fixed in 0.16.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66223

References

Other 1

  • TI-2024-16347 OpenObserve Privilege Escalation Vulnerability in Users API CVSS 3.1CRITICAL 10.0
  • TI-2024-36995 OpenObserve Improper Authorization Allows Admin User to Remove Root User CVSS 3.1HIGH 8.7
  • TI-2024-27852 OpenObserve stored XSS vulnerability may lead to complete account takeover CVSS 3.1HIGH 8.8
  • TI-2026-28348 OpenObserve has a SSRF Protection Bypass via IPv6 Bracket Notation in validate_enrichment_url CVSS 3.1HIGH 7.7
  • TI-2025-40082 OpenObserve Vulnerable to HTML Injection in Organization Invitation Emails CVSS 3.1LOW 3.5
  • TI-2024-16561 OpenObserve Unauthorized Access Vulnerability in Users API CVSS 3.1CRITICAL 9.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences