CVE-2024-2035
Improper Authorization in zenml-io/zenml
- State
- Published
- Severity
- 6.5 Medium
- Published
- Jun 6, 2024
- Updated
- Oct 21, 2025
- Reserved
- Feb 29, 2024
Description
An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the `active` status of user accounts to false, effectively deactivating them. This issue affects version 0.55.3 and was fixed in version 0.56.2. The impact of this vulnerability is significant as it allows for the deactivation of admin accounts, potentially disrupting the functionality and security of the application.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 6.5 Medium | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H | @huntr_ai |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
zenml-io/zenmlzenml-io |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.