Critical · published February 8, 2024
🚨 A critical oversight in OpenObserve allows any user to kick other members out of their organization — including Admins and Root users! 🔥 Think of an office where any employee can fire the CEO — it sounds outrageous, but that’s what's happening here! The user management system lacks a proper check, allowing any member to remove anyone else, regardless of their role. The consequences can be absolutely devastating! Imagine a situation where a rogue user decides to remove all Admins, locking everyone out and causing chaos in operations. This vulnerability not only threatens your organization's stability but also paves the way for unauthorized access and data breaches.
Think of an office where any employee can fire the CEO — it sounds outrageous, but that’s what's happening here! The user management system lacks a proper check, allowing any member to remove anyone else, regardless of their role. At the core of the issue is the `remove_user_from_org` function, which fails to verify if the user making the request has the administrative rights to perform such an action. This means any authenticated member can remove users indiscriminately, leading to significant security concerns.
The consequences can be absolutely devastating! Imagine a situation where a rogue user decides to remove all Admins, locking everyone out and causing chaos in operations. This vulnerability not only threatens your organization's stability but also paves the way for unauthorized access and data breaches. To protect your organization, upgrade to version 0.8.0 immediately. Review user permissions carefully and implement strict role checks within your user management system to ensure only authorized personnel can remove users. This is fixable! Upgrade now and tighten your user management to keep your organization secure! 🛡️