Incorrect authorization in jupyterhub - #VU162714
Published: November 9, 2026
Vulnerability identifier: #VU162714
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an administrator with filtered user or group permissions to create users or groups outside their authorized scope in JupyterHub.
The vulnerability exists due to improper scope enforcement during user and group creation in deployments configured with custom roles granting filtered administrative access. An administrator with filtered user or group permissions can submit creation requests for out-of-scope users or groups without gaining administrative access to them.
Affected software
jupyterhub
Remediation
Install security update from vendor's website.
jupyterhub - update to 5.5.1