2018-SV3 Modify User Password

affects OMERO 5 versions 5.4.6 and earlier

back to Advisories


Restricted administrators who are permitted to modify users can change the password of administrators more powerful than themselves then log in using that new password to gain elevated privileges.


Without the ModifyUser restriction an administrator may,

  1. Change another administrator's e-mail address to their own.

  2. Reset that administrator's password.

  3. Read the new password from the e-mail sent by OMERO.server.

  4. Log in as that other administrator.


  1. Change another administrator's password to a given value.

  2. Log in as that other administrator.

This vulnerability is identified as CVE-2018-1000634.

Affected Packages

OMERO.server from 5.4.0 to 5.4.6 inclusive.


Medium severity.

CVSS score 5.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N/E:F/RL:O/RC:C


Do not give restricted administrators such as Group and Data Organizer the ability to Create and Edit Users. This corresponds to the ModifyUser restriction as viewed from OMERO.cli.


All OMERO.servers should be upgraded to at least 5.4.7.

back to top