CVE-2024-48898

What it actually does

Authorization bypass allowing users with delete audience access on one report to delete audiences belonging to other reports without authorization.

Why it matters to the business

Unauthorized tampering with report configurations can corrupt reporting integrity and disrupt operational visibility across the platform; low urgency given no KEV listing, no ransomware use, and stable low EPSS over 30 days.

How an attack unfolds

An authenticated user with limited delete permissions identifies audience identifiers from other reports and issues crafted delete requests that bypass ownership checks.

How to fix it

Update affected installations to the listed fixed versions: libarchive (Ubuntu:14.04:LTS) 3.1.2-7ubuntu2.3 or libarchive (Ubuntu:16.04:LTS) 3.1.2-11ubuntu0.16.04.2.

How to confirm the fix worked

After patching, verify that delete-audience operations are rejected when the user lacks permission on the target report.

Typical attack path

1. Obtain an account with delete-audience permission on at least one report
2. Discover audience or report identifiers outside the permitted scope
3. Submit delete-audience requests targeting unauthorized reports
4. Confirm successful removal of protected audiences

How to detect it

Inspect application logs for audience-delete events performed by users lacking ownership of the target report.

What your security team should do

• Apply the fixed package versions for all listed Ubuntu releases
• Review and tighten report audience permissions across the instance
• Enable logging of audience delete operations for anomaly review