CVE-2024-55954 Overview
OpenObserve is a cloud-native observability platform used for logs, metrics, and traces. CVE-2024-55954 is a privilege escalation vulnerability [CWE-269] in the user management endpoint /api/{org_id}/users/{email_id}. The remove_user_from_org function fails to enforce the intended role hierarchy. An attacker holding the Admin role can invoke DELETE /api/{org_id}/users/{email_id} to remove a Root user from the organization. Eliminating the highest-privileged accounts allows the attacker to seize effective full control of the tenant. The issue is fixed in release 0.14.1, and no workarounds exist.
Critical Impact
An authenticated Admin can delete Root-level accounts, breaking the OpenObserve privilege model and enabling takeover of the organization.
Affected Products
- OpenObserve versions prior to 0.14.1
- Deployments exposing the /api/{org_id}/users/{email_id} endpoint
- Multi-tenant OpenObserve organizations with Admin and Root role separation
Discovery Timeline
- 2025-01-16 - CVE-2024-55954 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-55954
Vulnerability Analysis
OpenObserve enforces a role hierarchy where Root accounts sit above Admin accounts. Administrative operations that target higher-privileged users must therefore reject callers holding a lower role. The remove_user_from_org function in src/service/users.rs does not perform this comparative role check before deleting the target user. As a result, the DELETE /api/{org_id}/users/{email_id} endpoint treats a Root target identically to any other user when an Admin initiates the request.
An attacker with valid Admin credentials issues a single authenticated HTTP DELETE against the target email identifier. The server removes the Root account from the organization without further authorization. Once the last Root user is removed, remaining Admin accounts inherit effective control of the tenant, including data ingestion pipelines, alerting rules, and stored observability data.
The attack requires network access to the API and prior possession of Admin credentials. It does not require user interaction. Impact spans confidentiality and integrity, since the attacker can subsequently reconfigure the organization and access telemetry data.
Root Cause
The root cause is missing role-hierarchy enforcement in remove_user_from_org in src/service/users.rs. The function authenticates the caller and confirms the target exists, but does not compare the caller's role against the target's role before performing the deletion.
Attack Vector
The vector is a network-reachable REST endpoint. An authenticated Admin sends DELETE /api/{org_id}/users/{email_id} where email_id identifies a Root account. The backend accepts the request and removes the account. See the GitHub Security Advisory GHSA-m8gj-6r85-3r6m and the GitHub Code Reference for the affected function.
Detection Methods for CVE-2024-55954
Indicators of Compromise
- HTTP DELETE requests to /api/{org_id}/users/{email_id} where the target email belongs to a Root account.
- Unexpected removal or absence of Root users from an organization's user list.
- Audit log entries showing Admin-initiated user deletions targeting privileged accounts.
Detection Strategies
- Parse OpenObserve API access logs for DELETE operations against the users endpoint and correlate the caller role with the target role.
- Alert on any successful user-deletion event where the target user previously held the Root role.
- Baseline normal Admin activity and flag deviations such as bulk deletions of privileged accounts.
Monitoring Recommendations
- Ship OpenObserve application and access logs to a centralized analytics platform for retention and correlation.
- Monitor role assignment changes and user roster snapshots for unexpected privileged-account removals.
- Track authentication anomalies on Admin accounts, including new source IPs, tokens, or off-hours activity preceding user deletions.
How to Mitigate CVE-2024-55954
Immediate Actions Required
- Upgrade OpenObserve to version 0.14.1 or later across all deployments.
- Audit the current user roster for each organization and reinstate any missing Root accounts.
- Rotate credentials and API tokens for Admin users, particularly where activity cannot be fully attributed.
- Review historical audit logs for prior invocations of DELETE /api/{org_id}/users/{email_id} against Root accounts.
Patch Information
The maintainers addressed the flaw in OpenObserve release 0.14.1 by adding role-hierarchy checks so Admin users cannot remove Root users. Details are documented in the GitHub Security Advisory GHSA-m8gj-6r85-3r6m. There are no vendor-provided workarounds; upgrading is the required remediation.
Workarounds
- No official workarounds are available. Restrict Admin role assignments to trusted operators until the upgrade is applied.
- Place the OpenObserve API behind network access controls that limit exposure of the user management endpoints to administrative networks only.
- Enforce multi-factor authentication on all Admin and Root accounts to reduce the risk of credential compromise leading to exploitation.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
