Affects OMERO.web <=5.33.2
XSS vulnerability when removing user
When an administrator attempts to remove a user from their only group, the action fails with an error message that contains the user's first and last name. Those values are not HTML encoded, so they provide a vector for executing code within the administrator's browser session. Possible actions include creating additional administrator accounts with known usernames and passwords. For a successful exploit, a user must already have an account in OMERO and change their first and last names for the account to the desired malicious code. They also must be member of only a single group and then get an existing administrator to attempt to remove them from that group.
OMERO.web <=5.33.2
High severity.
All OMERO.web deployments should be upgraded to at least 5.33.3.
© 2005-2026 University of Dundee & Open Microscopy Environment. Creative Commons Attribution 4.0 International License
OME source code is available under the GNU General public license or more permissive open source licenses, or through commercial license from Glencoe Software Inc.
OME, Bio-Formats, OMERO, IDR and their associated logos are trademarks of Glencoe Software Inc., which holds these marks to protect them on behalf of the OME community.
[ Site Map ]
Version: 2026.11.05