JupyterHub has a privilege escalation vulnerability with the `admin:users` scope
Summary
If a user is granted the admin:users scope, they may escalate their own privileges by making themselves a full admin user.
Details
The admin:users scope allows a user to edit user records:
admin:users
Read, write, create and delete users and their authentication state, not including their servers or tokens.
-- https://jupyterhub.readthedocs.io/en/stable/rbac/scopes.html#available-scopes
However, this includes making users admins. Admin users are granted scopes beyond admin:users making this a mechanism by which granted scopes may be escalated.
Impact
The impact is relatively small in that admin:users is already an extremely privileged scope only granted to trusted users.
In effect, admin:users is equivalent to admin=True, which is not intended.
Note that the change here only prevents escalation to the built-in JupyterHub admin role that has unrestricted permissions. It does not prevent users with e.g. groups permissions from granting themselves or other users permissions via group membership, which is intentional.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | jupyterhub | < 4.1.6, >= 5.0.0, < 5.1.0 | 4.1.6, 5.1.0 |
References
- https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-9x4q-3gxw-849f
- https://github.com/jupyterhub/jupyterhub/commit/99e2720b0fc626cbeeca3c6337f917fdacfaa428
- https://github.com/jupyterhub/jupyterhub/commit/ff2db557a85b6980f90c3158634bf924063ab8ba
- https://nvd.nist.gov/vuln/detail/CVE-2024-41942
- https://github.com/jupyterhub/jupyterhub
- https://github.com/pypa/advisory-database/tree/main/vulns/jupyterhub/PYSEC-2024-200.yaml
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-274- Platform
- Python (PyPI)
- Package
jupyterhub- Disclosed
- 08.08.2024
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2024-200 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-9x4q-3gxw-849f - CC BY 4.0
Vulnerability history: jupyterhub
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 8
- First → latest
- 04.2019 08.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 6
Disclosures per year
- 2019: 1
- 2020: 0
- 2021: 2
- 2022: 0
- 2023: 0
- 2024: 2
- 2025: 0
- 2026: 3
-
JupyterHub has a privilege escalation vulnerability with the `admin:users` scope this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.