CVE-2024-24778: Apache StreamPipes has improper privilege management in a REST interface

March 3, 2025 (updated July 9, 2025)

Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was known.

This issue affects Apache StreamPipes: through 0.95.1.

Users are recommended to upgrade to version 0.97.0 which fixes the issue.

References

github.com/advisories/GHSA-vm7w-2724-5m23
github.com/apache/streampipes
github.com/pypa/advisory-database/tree/main/vulns/streampipes/PYSEC-2025-66.yaml
lists.apache.org/thread/j14w6wghlwwrgfgc6hoz9f94fwxtlgzh
nvd.nist.gov/vuln/detail/CVE-2024-24778

Code Behaviors & Features

Detect and mitigate CVE-2024-24778 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →