Every CVE Search/ Get API key

CVE-2024-2035

Improper Authorization in zenml-io/zenml

6.5 MediumFix available

An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the active status of user accounts to false, effectively deactivating them. This issue affects version 0.55.3 and was fixed in version 0.56.2. The impact of this vulnerability is significant as it allows for the deactivation of admin accounts, potentially disrupting the functionality and security of the application.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
High

Exploit likelihood

0.62%Up 0.6 points since Jun 7, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.5

Improper Authorization in zenml-io/zenml

An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the active status of user accounts to false, effectively deactivating them. This issue affects version 0.55.3 and was fixed in version 0.56.2. The impact of this vulnerability is significant as it allows for the deactivation of admin accounts, potentially disrupting the functionality and security of the application.

Record
CVE-2024-2035
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-862
Updated
2026-11-02
EUVDEUVD-2024-0194 6.5

An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the active status of user accounts to false, effectively deactivating them. This issue affects version 0.55.3 and was fixed in version 0.56.2. The impact of this vulnerability is significant as it allows for the deactivation of admin accounts, potentially disrupting the functionality and security of the application.

Record
EUVD-2024-0194
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-9x88-4jg8-4vf7 6.5

Improper authorization in zenml

An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the active status of user accounts to false, effectively deactivating them. This issue affects version 0.55.3 and was fixed in version 0.56.2. The impact of this vulnerability is significant as it allows for the deactivation of admin accounts, potentially disrupting the functionality and security of the application.

Record
GHSA-9x88-4jg8-4vf7
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-862, CWE-1220
Updated
2026-11-02
NVD 6.5

An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the active status of user accounts to false, effectively deactivating them. This issue affects version 0.55.3 and was fixed in version 0.56.2. The impact of this vulnerability is significant as it allows for the deactivation of admin accounts, potentially disrupting the functionality and security of the application.

Record
CVE-2024-2035
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-862
Updated
2026-11-02
OSV 6.5

Improper Authorization in zenml-io/zenml

An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the active status of user accounts to false, effectively deactivating them. This issue affects version 0.55.3 and was fixed in version 0.56.2. The impact of this vulnerability is significant as it allows for the deactivation of admin accounts, potentially disrupting the functionality and security of the application.

Record
CVE-2024-2035
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-862
Updated
2026-11-02
OSVGHSA-9x88-4jg8-4vf7 6.5

Improper authorization in zenml

An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the active status of user accounts to false, effectively deactivating them. This issue affects version 0.55.3 and was fixed in version 0.56.2. The impact of this vulnerability is significant as it allows for the deactivation of admin accounts, potentially disrupting the functionality and security of the application.

Record
GHSA-9x88-4jg8-4vf7
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-1220, CWE-862
Updated
2026-11-02
OSVPYSEC-2024-169 6.5

An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the active status of user accounts to false, effectively deactivating them. This issue affects version 0.55.3 and was fixed in version 0.56.2. The impact of this vulnerability is significant as it allows for the deactivation of admin accounts, potentially disrupting the functionality and security of the application.

Record
PYSEC-2024-169
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
zenml
PyPI
 before 0.56.2
0.56.2
zenml
PyPI
 before 0.56.2, plus listed versions
0.0.1rc10.0.1rc20.1.00.1.10.1.2
Show 45 moreShow less
0.1.30.1.3rc00.1.40.1.50.10.00.11.00.12.00.13.00.13.10.13.20.2.00.2.0rc10.2.0rc20.20.00.20.0rc10.20.10.20.20.20.30.20.40.20.50.21.00.21.10.22.00.23.00.3.10.3.1rc00.3.20.3.30.3.3rc00.3.40.3.4rc00.3.50.3.5rc00.3.60.3.6.10.3.6rc00.3.70.3.7.1rc00.3.7.1rc10.3.7.1rc30.3.7.1rc40.3.7rc00.3.80.3.9rc10.3.9rc2
0.56.2
zenml
PyPI
 before 0.56.2, plus listed versions
0.0.1rc10.0.1rc20.1.00.1.10.1.2
Show 45 moreShow less
0.1.30.1.3rc00.1.40.1.50.10.00.11.00.12.00.13.00.13.10.13.20.2.00.2.0rc10.2.0rc20.20.00.20.0rc10.20.10.20.20.20.30.20.40.20.50.21.00.21.10.22.00.23.00.3.10.3.1rc00.3.20.3.30.3.3rc00.3.40.3.4rc00.3.50.3.5rc00.3.60.3.6.10.3.6rc00.3.70.3.7.1rc00.3.7.1rc10.3.7.1rc30.3.7.1rc40.3.7rc00.3.80.3.9rc10.3.9rc2
0.56.2

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-2035 is a medium vulnerability (CVSS 6.5) in Zenml, published June 6, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 50th percentile. Fixed in zenml 0.56.2.

References

This page doesn't list everything

Left out here: 165 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open