Executive Summary

This vulnerability in OpenObserve (up to version 0.16.1) occurs when creating or renaming an organization with HTML content in its name. The HTML markup is rendered inside the invitation email without proper escaping, meaning user-controlled input is directly inserted into the email template. This can lead to unintended HTML rendering in emails.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to potential information disclosure or manipulation through the rendering of unescaped HTML in invitation emails. Although the CVSS score indicates low severity with no confidentiality or availability impact, it could allow an attacker to inject malicious HTML content into emails, potentially misleading recipients or causing minor integrity issues.

Useful 0 Not Useful 0

Mitigation Strategies

Since no patched versions are available, immediate mitigation steps include avoiding creating or renaming organizations with HTML content in their names to prevent injection of unescaped markup into invitation emails. Additionally, review and restrict user input fields to disallow HTML markup until a fix is released.

Useful 0 Not Useful 0