Executive brief
ETSI Open-Source MANO (OSM), a platform used by telecommunications providers to manage virtual network functions, contains a security flaw in its user management component. An attacker with a standard user account can exploit this to grant themselves administrative privileges or take over other user accounts, including the system administrator. This could lead to a total compromise of the network management platform, allowing unauthorized changes to network services or a complete service outage.
Technical details
A Broken Object Level Authorization (BOLA) vulnerability exists in the /osm/admin/v1/users API endpoint of ETSI Open-Source MANO. The root cause is improper implementation of access controls, where the system fails to validate if a low-privileged user has the authority to modify user objects other than their own. A remote authenticated attacker can send a crafted PATCH request to the endpoint to change their own role to 'system_admin', reset passwords for other accounts (including the default admin), or modify usernames. This allows for full privilege escalation, account takeover, and denial of service. The issue is fixed in versions 14.0.3, 15.0.2, and 17.0.1, with a specific commit fix available for version 16.0.0.
Affected products
- ETSI Open-Source MANO (OSM) 14.0.x before 14.0.3, 15.0.x before 15.0.2, 16.0.0, 17.0.0
Timeline
- 2025-07-25: advisory: NVD publication date
- 2025-07-25: disclosed: Initial disclosure by Osmium Solutions