Cross organization admin control in Grafana
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.
Summary
Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance admins are able to access users from other organizations. Grafana 8.0 introduced a mechanism which allowed users with the Organization Admin role to list, add, remove, and update users’ roles in other organizations in which they are not an admin. With fine-grained access control enabled, organization admins can list, add, remove and update users' roles in another organization, where they do not have organization admin role. All installations between v8.0 and v8.2.3 that have fine-grained access control beta enabled and more than one organization should be upgraded as soon as possible. If you cannot upgrade, you should turn off the fine-grained access control using a feature flag.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Grafana | grafana | 8.0.0 to before 8.2.4 | 8.2.4 | Patch available | CNA |
| — | github.com/grafana/grafana (Go) | 8.0.0 to before 8.2.4 | 8.2.4 | Patch available | GHSA-mpwp-42x6-4wmx |
- grafana VendorGrafana Affected 8.0.0 to before 8.2.4 Fixed in 8.2.4 Patch available CNA
- github.com/grafana/grafana (Go) Vendor— Affected 8.0.0 to before 8.2.4 Fixed in 8.2.4 Patch available GHSA-mpwp-42x6-4wmx
Remediation
- Fix · CNA grafana (grafana) Fixed in 8.2.4
- Fix · GHSA-mpwp-42x6-4wmx github.com/grafana/grafana (Go) Fixed in 8.2.4 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 2 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
Not affected: 9 products
- OpenShift Service Mesh 2.0
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ceph Storage 4
- Red Hat Ceph Storage 5
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4
- Red Hat Storage 3
Timeline
- 2026-10-02 Threatist record created from CVE-2021-41244
- 2026-10-03 Alias added: GHSA-mpwp-42x6-4wmx
References
Advisory 5
- https://github.com/grafana/grafana/security/advisories/GHSA-mpwp-42x6-4wmx
- https://grafana.com/blog/2021/11/15/grafana-8.2.4-released-with-security-fixes/
- [oss-security] 20211115 Grafana 8.2.4 released with security fixes
- https://security.netapp.com/advisory/ntap-20211223-0001/
- https://nvd.nist.gov/vuln/detail/CVE-2021-41244
More Grafana vulnerabilities
- TI-2021-16611 Snapshot authentication bypass in grafana KEVCVSS 3.1CRITICAL 9.8
- TI-2021-19604 Grafana path traversal KEVCVSS 3.1HIGH 7.5
- TI-2024-08600 Grafana SQL Expressions allow for remote code execution CVSS 4.0CRITICAL 9.4
- TI-2023-02931 Authentication bypass by spoofing in Grafana CVSS 3.1CRITICAL 9.8
- TI-2020-10491 The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control… CVSS 3.1HIGH 8.2
- TI-2025-03662 Open redirect in Grafana CVSS 3.1HIGH 7.6
Sources
- CVE-2021-41244 · CVE Program
- CVE-2021-41244 · NVD
- FIRST EPSS
- GHSA-mpwp-42x6-4wmx · GitHub Advisory Database · CC BY 4.0
- CVE-2021-41244 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences