CVE-2024-24830: Openobserve User Creation Missing Initiator Authz
This `post_user` handler accepts a `UserRequest` (which carries a caller-supplied `role`) but takes no `initiator_id` parameter and performs no Root/Admin authorization check on the caller. Any authenticated user can therefore create an account with elevated privileges (e.g. `UserRole::Root`), enabling vertical privilege escalation (CVE-2024-24830). Fix: add
greprules fetch cve-2024-24830-openobserve-user-creation-missing-initiator-authz --engine opengrepDescription
This `post_user` handler accepts a `UserRequest` (which carries a caller-supplied `role`) but takes no `initiator_id` parameter and performs no Root/Admin authorization check on the caller. Any authenticated user can therefore create an account with elevated privileges (e.g. `UserRole::Root`), enabling vertical privilege escalation (CVE-2024-24830). Fix: add
Detection target
Not provided
Recommended fix
Not provided
False-positive notes
Not provided
Community feedback
Sign in to report false positives, mark this rule useful, or suggest metadata improvements.