CVE-2024-22409

    Dashboard / Vulnerabilities / CVE-2024-22409

    CVE-2024-22409

    Published: 16 Jan 2024Last Modified: 12 Aug 2026

    Summary: Default Privileges allow for high level operations for low privileged users in datahub

    Details: DataHub is an open-source metadata platform. In affected versions a low privileged user could remove a user, edit group members, or edit another user's profile information. The default privileges gave too many broad permissions to low privileged users. These have been constrained in PR #9067 to prevent abuse. This issue can result in privilege escalation for lower privileged users up to admin privileges, potentially, if a group with admin privileges exists. May not impact instances that have modified default privileges. This issue has been addressed in datahub version 0.12.1. Users are advised to upgrade.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22409.json, https://github.com/datahub-project/datahub/security/advisories/GHSA-x3v6-r479-m4xv, https://nvd.nist.gov/vuln/detail/CVE-2024-22409, https://github.com/datahub-project/datahub/pull/9067

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -159a013b0515f8a94b88d62e4ad20aad228fac9d

    Affected versions

    v0.12.1rc2
    v0.12.1rc1
    v0.12.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-22409 | CVE-DB