Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2023-4822

Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several…

Medium6.7EPSS 1.3%
Published
Updated
Reserved
Assigned by
GRAFANA

Description

Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations. It also allows an Organization Admin to assign or revoke any permissions that they have to any user globally. This means that any Organization Admin can elevate their own permissions in any organization that they are already a member of, or elevate or restrict the permissions of any other user. The vulnerability does not allow a user to become a member of an organization that they are not already a member of, or to add any other users to an organization that the current user is not a member of.

Scores

CVSS scores of CVE-2023-4822, by who scored it
Scored byCVSSScoreVector
GRAFANACNA (assigner)3.1Medium6.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
NVDNVD · Modified3.1High7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
1.3% · top 30% of all CVEs (6 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.7.

Weakness

Affected products

  • Grafana · Grafana Enterprise

    • affected 8.0.0 – < 9.4.16
    • affected 9.5.0 – < 9.5.11
    • affected 10.0.0 – < 10.0.7
    • affected 10.1.0 – < 10.1.3

Affected packages

From reviewed advisories of the GitHub Advisory Database.

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2023-4822 badge
[![CVE-2023-4822](https://trackcve.app/badge/CVE-2023-4822.svg)](https://trackcve.app/cve/CVE-2023-4822)

Record last updated .