I have the following scopes for the group admin:
- ‘read:users’
- ‘admin:users!group=test-group’
- ‘admin:groups!group=test-group’
- ‘admin-ui’
needed to add/delete/create/read users to the specific group he manages, in this case test group. However in the add users section(as shown in the picture) this admin can add a general admin. I want the admin of the group to only be able to create and add simple users to the group, not admins.
help is much appreciated
This can be fixed by upgrading to JupyterHub 4.1.6 or 5.1.0. admin:users
is not meant to grant access to the admin
property, reported as CVE-2024-41942
.
2 Likes