https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 07:39:22 +0000 https://cve.radiocsirt.org/vuln/bit-jupyterhub-2024-41942 <p><strong>Affected:</strong> Bitnami: jupyterhub</p> <p>JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the `admin:users` scope, they may escalate their own privileges by making themselves a full admin user. The impact is relatively small in that `admin:users` is already an extremely privileged scope only granted to trusted users. In effect, `admin:users` is equivalent to `admin=True`, which is not intended. Note that the change here only prevents escalation to the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g. `groups` permissions from granting themselves or other users permissions via group membership, which is intentional. Versions 4.1.6 and 5.1.0 fix this issue.</p> <p><strong>Affected:</strong> Bitnami: jupyterhub</p> <p>JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the `admin:users` scope, they may escalate their own privileges by making themselves a full admin user. The impact is relatively small in that `admin:users` is already an extremely privileged scope only granted to trusted users. In effect, `admin:users` is equivalent to `admin=True`, which is not intended. Note that the change here only prevents escalation to the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g. `groups` permissions from granting themselves or other users permissions via group membership, which is intentional. Versions 4.1.6 and 5.1.0 fix this issue.</p> https://cve.radiocsirt.org/vuln/bit-jupyterhub-2024-41942 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0106 certfr-2025-avi-0106 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0106 https://cve.radiocsirt.org/vuln/euvd-2026-157828 EUVD-2026-157828 https://cve.radiocsirt.org/vuln/euvd-2026-157828 https://cve.radiocsirt.org/vuln/fkie_cve-2024-41942 <p>JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the `admin:users` scope, they may escalate their own privileges by making themselves a full admin user. The impact is relatively small in that `admin:users` is already an extremely privileged scope only granted to trusted users. In effect, `admin:users` is equivalent to `admin=True`, which is not intended. Note that the change here only prevents escalation to the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g. `groups` permissions from granting themselves or other users permissions via group membership, which is intentional. Versions 4.1.6 and 5.1.0 fix this issue.</p> <p>JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the `admin:users` scope, they may escalate their own privileges by making themselves a full admin user. The impact is relatively small in that `admin:users` is already an extremely privileged scope only granted to trusted users. In effect, `admin:users` is equivalent to `admin=True`, which is not intended. Note that the change here only prevents escalation to the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g. `groups` permissions from granting themselves or other users permissions via group membership, which is intentional. Versions 4.1.6 and 5.1.0 fix this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-41942 https://cve.radiocsirt.org/vuln/ghsa-9x4q-3gxw-849f <p><strong>Affected:</strong> PyPI: jupyterhub</p> <p>### Summary</p> <p>If a user is granted the `admin:users` scope, they may escalate their own privileges by making themselves a full admin user.</p> <p>### Details</p> <p>The `admin:users` scope allows a user to edit user records:</p> <p>&gt; admin:users &gt; &gt; Read, write, create and delete users and their authentication state, not including their servers or tokens. &gt; &gt; -- https://jupyterhub.readthedocs.io/en/stable/rbac/scopes.html#available-scopes</p> <p>However, this includes making users admins. Admin users are granted scopes beyond `admin:users` making this a mechanism by which granted scopes may be escalated.</p> <p>### Impact</p> <p>The impact is relatively small in that `admin:users` is already an extremely privileged scope only granted to trusted users. In effect, `admin:users` is equivalent to `admin=True`, which is not intended.</p> <p>Note that the change here only prevents escalation to the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g. `groups` permissions from granting themselves or other users permissions via group membership, which is intentional.</p> <p><strong>Affected:</strong> PyPI: jupyterhub</p> <p>### Summary</p> <p>If a user is granted the `admin:users` scope, they may escalate their own privileges by making themselves a full admin user.</p> <p>### Details</p> <p>The `admin:users` scope allows a user to edit user records:</p> <p>&gt; admin:users &gt; &gt; Read, write, create and delete users and their authentication state, not including their servers or tokens. &gt; &gt; -- https://jupyterhub.readthedocs.io/en/stable/rbac/scopes.html#available-scopes</p> <p>However, this includes making users admins. Admin users are granted scopes beyond `admin:users` making this a mechanism by which granted scopes may be escalated.</p> <p>### Impact</p> <p>The impact is relatively small in that `admin:users` is already an extremely privileged scope only granted to trusted users. In effect, `admin:users` is equivalent to `admin=True`, which is not intended.</p> <p>Note that the change here only prevents escalation to the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g. `groups` permissions from granting themselves or other users permissions via group membership, which is intentional.</p> https://cve.radiocsirt.org/vuln/ghsa-9x4q-3gxw-849f https://cve.radiocsirt.org/vuln/pysec-2024-200 <p><strong>Affected:</strong> PyPI: jupyterhub</p> <p>JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the `admin:users` scope, they may escalate their own privileges by making themselves a full admin user. The impact is relatively small in that `admin:users` is already an extremely privileged scope only granted to trusted users. In effect, `admin:users` is equivalent to `admin=True`, which is not intended. Note that the change here only prevents escalation to the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g. `groups` permissions from granting themselves or other users permissions via group membership, which is intentional. Versions 4.1.6 and 5.1.0 fix this issue.</p> <p><strong>Affected:</strong> PyPI: jupyterhub</p> <p>JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the `admin:users` scope, they may escalate their own privileges by making themselves a full admin user. The impact is relatively small in that `admin:users` is already an extremely privileged scope only granted to trusted users. In effect, `admin:users` is equivalent to `admin=True`, which is not intended. Note that the change here only prevents escalation to the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g. `groups` permissions from granting themselves or other users permissions via group membership, which is intentional. Versions 4.1.6 and 5.1.0 fix this issue.</p> https://cve.radiocsirt.org/vuln/pysec-2024-200 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-41942 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: jupyterhub, Ubuntu:24.04:LTS: jupyterhub, Ubuntu:25.10: jupyterhub, Ubuntu:26.04:LTS: jupyterhub</p> <p>JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the `admin:users` scope, they may escalate their own privileges by making themselves a full admin user. The impact is relatively small in that `admin:users` is already an extremely privileged scope only granted to trusted users. In effect, `admin:users` is equivalent to `admin=True`, which is not intended. Note that the change here only prevents escalation to the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g. `groups` permissions from granting themselves or other users permissions via group membership, which is intentional. Versions 4.1.6 and 5.1.0 fix this issue.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: jupyterhub, Ubuntu:24.04:LTS: jupyterhub, Ubuntu:25.10: jupyterhub, Ubuntu:26.04:LTS: jupyterhub</p> <p>JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is granted the `admin:users` scope, they may escalate their own privileges by making themselves a full admin user. The impact is relatively small in that `admin:users` is already an extremely privileged scope only granted to trusted users. In effect, `admin:users` is equivalent to `admin=True`, which is not intended. Note that the change here only prevents escalation to the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g. `groups` permissions from granting themselves or other users permissions via group membership, which is intentional. Versions 4.1.6 and 5.1.0 fix this issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-41942