CVE-2025-66223 - CVE House
Back to Database
Status published High CVE-2025-66223

OpenObserve's Invite Token Lifecycle Misconfiguration

Vulnerability Description

OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remain valid even after the invited user is removed from the organization, and allow multiple invitations to the same email with different roles where all issued links remain valid simultaneously. This results in broken access control where a removed or demoted user can regain access or escalate privileges. This issue has been patched in version 0.16.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66223

Credits & Attribution

No credits recorded in the NVD database.

References

More from openobserve

View All →
CVE-2025-64744
OpenObserve Vulnerable to HTML Injection in Organization Invitation Emails
Low 3.5
CVE-2024-55954
OpenObserve Improper Authorization Allows Admin User to Remove Root User
High 8.7
CVE-2024-41809
OpenObserve Cross-site Scripting (XSS) vulnerability in `openobserve/web/src/views/MemberSubscription.vue`
High 7.2
CVE-2024-41808
OpenObserve stored XSS vulnerability may lead to complete account takeover
High 8.8
CVE-2024-25106
OpenObserve Unauthorized Access Vulnerability in Users API
Critical 9.1

Affected Vendor

openobserve

View all reports →

Affected Software

openobserve
Vulnerable Versions:
< 0.16.0

Timeline

Official Publish: November 29th, 2025
Last Modified: December 1st, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-613 CWE-284

MITRE ATT&CK TTPs

T1539 Steal Web Session Cookie
Credential Access
T1078 Valid Accounts
Persistence
T1550 Use Alternate Authentication Material
Defense Evasion
T1021 Remote Services
Lateral Movement
T1562 Impair Defenses
Defense Evasion
T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact