CVE-2023-4822Medium· 6.7▾ SunlitA flaw was found in the Grafana enterprise package. Grafana is incorrectly assessing permissions to update global roles and role assignments, therefore, users with administrator permissions in one organization can change global role permis…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 36.9 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
1.1%
Last analysed / modified upstream
A flaw was found in the Grafana enterprise package. Grafana is incorrectly assessing permissions to update global roles and role assignments, therefore, users with administrator permissions in one organization can change global role permissions and global role assignments. After successful exploitation, an attacker who has the Organization Admin role in any organization can elevate their permissions across all organizations, elevate other users’ permissions in all organizations, or limit other users’ permissions in all organizations.
grafana: incorrect assessment of permissions across organizations — rated Moderate by Red Hat. Released 2023-10-12, updated 2026-09-17.
Fixed:
Not affected:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
For supported configurations, refer to:
https://access.redhat.com/articles/1548993 https://access.redhat.com/errata/RHSA-2024:3925
Affected packages:
github.com/grafana/grafana <= 10.1.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93433Medium· 5.5A flaw was found in libstoragemgmt
CVE-2026-92382Medium· 4.1An out-of-bounds write flaw was found in usbredir
CVE-2026-94449High· 7.5A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices
CVE-2026-80110High· 8.1A flaw was found in pki-core
CVE-2026-75939High· 7.4A flaw was found in openshift/oc-mirror
CVE-2026-94184High· 8.1A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support