4.4
Medium
CVE-2024-6322 Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user…
Description
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| grafana 11.1 | 11.1.0 → < 11.1.3 | 11.1.1 |
| Grafana Enterprise 11.1 | 11.1.0 → < 11.1.3 | 11.1.1 |
Other CVEs of grafana
The 59 CVEs of grafana →
CVE-2026-27879
A resample query can be used to trigger out-of-memory crashes in Grafana
6.5
Medium
CVE-2026-28375
A testdata data-source can be used to trigger out-of-memory crashes in Grafana
6.5
Medium
CVE-2026-27876
RCE on Grafana via sqlExpressions
9.1
Critical
CVE-2026-27880
The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory…
7.5
High