5.4
Medium
CVE-2023-6152 A user changing their email after signing up and verifying it can change it without verification in profile settings
Description
A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| grafana 10.3 | 10.3.0 → < 10.3.3 | 10.3.3 |
| grafana 10.2 | 10.2.0 → < 10.2.4 | 10.2.4 |
| grafana 10.1 | 10.1.0 → < 10.1.7 | 10.1.7 |
| grafana 10.0 | 10.0.0 → < 10.0.11 | 10.0.11 |
| grafana 2.5 | 2.5.0 → < 9.5.16 | 9.5.16 |
| Grafana Enterprise 10.3 | 10.3.0 → < 10.3.3 | 10.3.3 |
| Grafana Enterprise 10.2 | 10.2.0 → < 10.2.4 | 10.2.4 |
| Grafana Enterprise 10.1 | 10.1.0 → < 10.1.7 | 10.1.7 |
| Grafana Enterprise 10.0 | 10.0.0 → < 10.0.11 | 10.0.11 |
Show the 6 other branches Hide the 6 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Grafana Enterprise 2.5 | 2.5.0 → < 9.5.16 | 9.5.16 |
| grafana_enterprise 10.3 | 10.3.0 → < 10.3.3 | 10.3.3 |
| grafana_enterprise 10.2 | 10.2.0 → < 10.2.4 | 10.2.4 |
| grafana_enterprise 10.1 | earliest → < 10.1.7 | 10.1.7 |
| grafana_enterprise 10.0 | 10.0.0 → < 10.0.11 | 10.0.11 |
| grafana_enterprise 2.5 | 2.5.0 → < 9.5.16 | 9.5.16 |
Other CVEs of grafana
The 59 CVEs of grafana →
CVE-2026-27879
A resample query can be used to trigger out-of-memory crashes in Grafana
6.5
Medium
CVE-2026-28375
A testdata data-source can be used to trigger out-of-memory crashes in Grafana
6.5
Medium
CVE-2026-27876
RCE on Grafana via sqlExpressions
9.1
Critical
CVE-2026-27880
The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory…
7.5
High