Github.Com Grafana Grafana vulnerabilities

CVE-2024-11741 [MEDIUM] CWE-200 Grafana Alerting VictorOps integration could be exposed to users with Viewer permission Grafana Alerting VictorOps integration could be exposed to users with Viewer permission Grafana is an open-source platform for monitoring and observability. The Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. Fixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15

CVE-2022-36062 [LOW] CWE-281 Grafana folders admin only permission privilege escalation Grafana folders admin only permission privilege escalation Today we are releasing Grafana 9.1.6, 9.0.9, 8.5.13. This patch release includes a Moderate severity security fix for CVE-2022-36062 that affects Grafana instances which are using Grafana role-based access control (RBAC). Release 9.1.6, latest patch, also containing security fix: - [Download Grafana 9.1.6](https://grafana.com/grafana/download/9.1.6

CVE-2022-39324 [MEDIUM] CWE-79 Grafana Spoofing originalUrl of snapshots Grafana Spoofing originalUrl of snapshots To create a snapshot (and insert an arbitrary URL) the built-in role Viewer is sufficient. When a dashboard is shared as a local snapshot, the following three fields are offered in the web UI for a user to fill out: • Snapshotname • Expire • Timeout(seconds) After the user confirms creation of the snapshot (i.e. clicks the ”Local Snapshot” button) an HTTP POST request is sent to th

CVE-2026-21727 [LOW] CWE-732 Grafana legacy correlations allow cross-tenant disclosure and deletion Grafana legacy correlations allow cross-tenant disclosure and deletion --- hero: image: /static/img/heros/hero-legal2.svg content: "# Cross-Tenant Legacy Correlation Disclosure and Deletion" date: 2026-01-29 product: Grafana fixed_versions: - ">=11.6.11 >=12.0.9 >=12.1.6 >=12.2.4" --- A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation r

CVE-2024-10452 [LOW] CWE-639 Grafana org admin can delete pending invites in different org Grafana org admin can delete pending invites in different org Organization admins can delete pending invites created in an organization they are not part of.

CVE-2025-1088 [LOW] CWE-20 Grafana long dashboard title or panel name causes unresponsives Grafana long dashboard title or panel name causes unresponsives In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerability in Grafana. This issue affects Grafana: before 11.6.2 and is fixed in 11.6.2 and higher.