Description (CNA)
This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Grafana / Grafana OSS | affected 12.4.0 through 12.4.5; affected 11.2.0 through 11.6.16; affected 13.0.0 through 13.0.3; affected 13.1.0 through 13.1.0; affected 12.2.0 through 12.2.10; affected 12.3.0 through 12.3.8 |
| Grafana / Grafana Enterprise | affected 13.0.0 through 13.0.3; affected 12.2.0 through 12.2.10; affected 11.2.0 through 11.6.16; affected 12.3.0 through 12.3.8; affected 12.4.0 through 12.4.5; affected 13.1.0 through 13.1.0 |
CWE
CWE-863
References
ADP enrichment
No English description supplied.
No references supplied.