CVE-2024-29866: 
Datalust Seq vulnerability analysis and mitigation

Datalust Seq versions from 2022.1.7378 to 2024.1.11028 contain an Incorrect Access Control vulnerability (CVE-2024-29866) that allows Project Owner or Organization Owner users to escalate their privileges to System level. The vulnerability was discovered during internal testing by Datalust and disclosed on March 21, 2024 (NVD, Datalust Issue).

The vulnerability stems from an incorrect access control implementation that allows users with Project Owner or Organization Owner roles, as well as API keys with Project or Organization permissions (but not System permissions), to elevate their privileges to System level access. The issue has been assigned a CVSS v3.1 base score of 9.1 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) (NVD).

Successful exploitation of this vulnerability allows authenticated users with Project Owner or Organization Owner roles to gain System-level privileges, effectively bypassing intended access control restrictions. This could lead to unauthorized access to sensitive system configurations and data (Datalust Issue).

The vulnerability requires an authenticated user with either Project Owner or Organization Owner roles, or API keys with Project or Organization permissions. No additional user interaction is needed for exploitation (NVD).

Datalust recommends upgrading to Seq version 2024.1.11146 or 2023.4.11151 (for 2023.4 users). Alternatively, organizations can implement workarounds by: 1) Changing affected users' roles from Project Owner and Organization Owner to User (read/write), and 2) Removing Project and Organization permissions from API keys that don't have System permissions (Datalust Issue).