{"id":"CVE-2024-6322","aliases":["BIT-grafana-2024-6322","EUVD-2024-2596","GHSA-hh8p-374f-qgr5","GO-2024-3079","UBUNTU-CVE-2024-6322"],"status":"published","title":"Grafana plugin data sources vulnerable to access control bypass","description":"Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00305,"percentile":0.23485,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-266"],"published":"2024-08-20T17:52:06Z","modified":"2026-09-10T03:50:18Z","fixes":[{"ecosystem":"Go","package":"github.com/grafana/grafana","fixed_in":["11.1.1","11.1.3","0.0.0-20240725142242-c326d865c58b","1.9.2-0.20240725142242-c326d865c58b"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"grafana","fixed_in":["11.1.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.1.0"},{"last_affected":"11.1.0"},{"fixed":"11.1.1"}]}],"versions":["11.1.0"]},{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.1.2"},{"last_affected":"11.1.2"},{"fixed":"11.1.3"}]}],"versions":["11.1.2"]},{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.0-20240521130516-0072e4a92d89"},{"fixed":"0.0.0-20240725142242-c326d865c58b"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.2-0.20240521130516-0072e4a92d89"},{"fixed":"1.9.2-0.20240725142242-c326d865c58b"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"11.1.0"},{"fixed":"11.1.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"11.1.0"},{"fixed":"11.1.1"}]}],"versions":["11.1.0"]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"11.1.2"},{"fixed":"11.1.3"}]}],"versions":["11.1.2"]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-20240521130516-0072e4a92d89"},{"fixed":"0.0.0-20240725142242-c326d865c58b"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"1.9.2-0.20240521130516-0072e4a92d89"},{"fixed":"1.9.2-0.20240725142242-c326d865c58b"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0+dfsg-1"]}],"products":[{"vendor":"grafana","product":"grafana"},{"vendor":"grafana","product":"grafana enterprise"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2024-6322/","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6322","tags":["web","advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2024-6322","tags":["web"]},{"url":"https://github.com/grafana/grafana/commit/4cb3ba5d1a7ab8b9676034e89dada2fcde1766ef","tags":["web","fix"]},{"url":"https://github.com/grafana/grafana/commit/9cdba084a9100c6b11d32eef9d2bd53656c6964a","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-hh8p-374f-qgr5","tags":["advisory"]},{"url":"https://github.com/grafana/grafana","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-6322","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-6322","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-6322","description":"Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.","status":"published","published":"2024-08-20T17:52:06.232Z","modified":"2025-11-23T15:33:04.21Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:34:11.305983Z"}],"euvd":[{"id":"EUVD-2024-2596","description":"Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.","status":"published","published":"2024-08-20T17:52:06Z","modified":"2025-11-23T15:33:04Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:13.665045Z"}],"ghsa":[{"id":"GHSA-hh8p-374f-qgr5","title":"Grafana plugin data sources vulnerable to access control bypass","description":"Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.","status":"published","published":"2024-08-20T18:31:26Z","modified":"2025-07-09T15:20:28Z","cvss":[{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:L/SA:L","level":"medium"},{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:38:49.837727Z"}],"nvd":[{"id":"CVE-2024-6322","description":"Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.","status":"published","published":"2024-08-20T18:15:09.9Z","modified":"2026-06-17T08:17:46.607Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:10:19.870727Z"}],"osv":[{"id":"GHSA-hh8p-374f-qgr5","title":"Grafana plugin data sources vulnerable to access control bypass","description":"Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.","status":"published","published":"2024-08-20T18:31:26Z","modified":"2026-09-10T03:50:18.159775297Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L","level":"medium"},{"version":"4.0","score":5.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:L/SA:L","level":"medium"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T15:46:49.28217Z"},{"id":"UBUNTU-CVE-2024-6322","description":"Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.","status":"published","published":"2024-08-20T18:15:00Z","modified":"2025-11-04T05:13:40Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"BIT-grafana-2024-6322","description":"Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.","status":"published","published":"2024-08-23T07:19:28.601Z","modified":"2025-04-03T14:40:37.652Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"GO-2024-3079","title":"Grafana plugin data sources vulnerable to access control bypass in github.com/grafana/grafana","description":"Grafana plugin data sources vulnerable to access control bypass in github.com/grafana/grafana.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/grafana/grafana from v11.1.0 before v11.1.1, from v11.1.2 before v11.1.3.","status":"published","published":"2024-08-22T20:03:04Z","modified":"2026-02-04T04:33:32.558145Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}