Grafana Enterprise
Monthly
Broken access control in Grafana OSS and Enterprise allows an organization administrator to delete dashboard snapshots owned by other organizations on the same multi-tenant instance, and to recover a snapshot's secret delete key by supplying only its public share key. The flaw crosses organizational trust boundaries within a shared Grafana deployment, enabling a malicious or compromised org-admin to both exfiltrate snapshot delete credentials and destroy data belonging to tenants they should have no access to. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and authenticated-network accessibility make this straightforward to exploit for any actor who holds org-admin credentials.
Cross-organization permission data disclosure in Grafana OSS and Enterprise affects all multi-org deployments across a broad range of versions from 11.2.0 through 13.1.0. An authenticated Org Admin of any single organization can call the access-control permission search API endpoint with an actionPrefix filter and receive dashboard and folder UIDs along with per-user permission/scope mappings belonging to other organizations within the same Grafana stack. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the flaw is vendor-confirmed and the exploitation path is trivial for any Org Admin in a multi-org environment.
Cross-organization authorization bypass in Grafana OSS and Enterprise allows an authenticated Org Admin to delete public dashboards owned by a different organization by supplying the target dashboard's identifiers to the deletion endpoint. The missing tenant-isolation check on the delete operation means any Org Admin - regardless of their organizational scope - can reach and destroy dashboards across organizational boundaries. No public exploit has been identified at time of analysis, and the low CVSS score of 3.1 reflects the constrained impact and prerequisite of an existing Org Admin credential.
Remote code execution is achievable in Grafana installations through a chained attack combining SQL Expressions with a Grafana Enterprise plugin, affecting both open-source and Enterprise deployments. The vulnerability requires high-privilege authenticated access (PR:H) but enables cross-scope impact with complete system compromise once exploited. Only instances with the sqlExpressions feature toggle enabled are vulnerable, though Grafana recommends all users update to prevent future exploitation paths using this attack vector. No public exploit identified at time of analysis, and authentication as a high-privilege user is required per CVSS vector.
Broken access control in Grafana OSS and Enterprise allows an organization administrator to delete dashboard snapshots owned by other organizations on the same multi-tenant instance, and to recover a snapshot's secret delete key by supplying only its public share key. The flaw crosses organizational trust boundaries within a shared Grafana deployment, enabling a malicious or compromised org-admin to both exfiltrate snapshot delete credentials and destroy data belonging to tenants they should have no access to. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and authenticated-network accessibility make this straightforward to exploit for any actor who holds org-admin credentials.
Cross-organization permission data disclosure in Grafana OSS and Enterprise affects all multi-org deployments across a broad range of versions from 11.2.0 through 13.1.0. An authenticated Org Admin of any single organization can call the access-control permission search API endpoint with an actionPrefix filter and receive dashboard and folder UIDs along with per-user permission/scope mappings belonging to other organizations within the same Grafana stack. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the flaw is vendor-confirmed and the exploitation path is trivial for any Org Admin in a multi-org environment.
Cross-organization authorization bypass in Grafana OSS and Enterprise allows an authenticated Org Admin to delete public dashboards owned by a different organization by supplying the target dashboard's identifiers to the deletion endpoint. The missing tenant-isolation check on the delete operation means any Org Admin - regardless of their organizational scope - can reach and destroy dashboards across organizational boundaries. No public exploit has been identified at time of analysis, and the low CVSS score of 3.1 reflects the constrained impact and prerequisite of an existing Org Admin credential.
Remote code execution is achievable in Grafana installations through a chained attack combining SQL Expressions with a Grafana Enterprise plugin, affecting both open-source and Enterprise deployments. The vulnerability requires high-privilege authenticated access (PR:H) but enables cross-scope impact with complete system compromise once exploited. Only instances with the sqlExpressions feature toggle enabled are vulnerable, though Grafana recommends all users update to prevent future exploitation paths using this attack vector. No public exploit identified at time of analysis, and authentication as a high-privilege user is required per CVSS vector.