Description
Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a data source they should not be able to access.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Client Tools 15 | ansible | 2.9.21-1.5.1 | SUSE-SU-2021:2675-1 |
| SUSE Manager Client Tools 15 | dracut-saltboot | 0.1.1627546504.96a0b3e-1.27.1 | SUSE-SU-2021:2675-1 |
| SUSE Manager Client Tools 15 | golang-github-prometheus-prometheus | 2.27.1-3.31.1 | SUSE-SU-2021:2675-1 |
| SUSE Manager Client Tools 15 | grafana | 7.5.7-1.21.1 | SUSE-SU-2021:2660-1 |
| SUSE Manager Client Tools 15 | mgr-cfg | 4.2.3-1.18.1 | SUSE-SU-2021:2675-1 |
| SUSE Manager Client Tools 15 | mgr-custom-info | 4.2.2-1.12.1 | SUSE-SU-2021:2675-1 |
| SUSE Manager Client Tools 15 | mgr-osad | 4.2.6-1.30.1 | SUSE-SU-2021:2675-1 |
| SUSE Manager Client Tools 15 | mgr-push | 4.2.3-1.12.1 | SUSE-SU-2021:2675-1 |
| SUSE Manager Client Tools 15 | mgr-virtualization | 4.2.2-1.20.1 | SUSE-SU-2021:2675-1 |
| SUSE Manager Client Tools 15 | rhnlib | 4.2.4-3.28.1 | SUSE-SU-2021:2675-1 |
| SUSE Manager Client Tools 15 | spacecmd | 4.2.11-3.62.1 | SUSE-SU-2021:2675-1 |
| SUSE Manager Client Tools 15 | spacewalk-client-tools | 4.2.12-3.44.1 | SUSE-SU-2021:2675-1 |
| SUSE Manager Client Tools 15 | spacewalk-koan | 4.2.4-3.21.1 | SUSE-SU-2021:2675-1 |
| SUSE Manager Client Tools 15 | spacewalk-oscap | 4.2.2-3.12.1 | SUSE-SU-2021:2675-1 |
| SUSE Manager Client Tools 15 | suseRegisterInfo | 4.2.4-3.15.1 | SUSE-SU-2021:2675-1 |
| SUSE Manager Client Tools 15 | uyuni-common-libs | 4.2.5-1.15.1 | SUSE-SU-2021:2675-1 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-prometheus | 2.27.1-1.29.2 | SUSE-SU-2021:2673-1 |
| SUSE Manager Client Tools 12 | grafana | 7.5.7-1.21.2 | SUSE-SU-2021:2673-1 |
| SUSE Manager Client Tools 12 | mgr-cfg | 4.2.3-1.18.2 | SUSE-SU-2021:2673-1 |
| SUSE Manager Client Tools 12 | mgr-custom-info | 4.2.2-1.12.2 | SUSE-SU-2021:2673-1 |
| SUSE Manager Client Tools 12 | mgr-osad | 4.2.6-1.30.2 | SUSE-SU-2021:2673-1 |
| SUSE Manager Client Tools 12 | mgr-push | 4.2.3-1.12.2 | SUSE-SU-2021:2673-1 |
| SUSE Manager Client Tools 12 | mgr-virtualization | 4.2.2-1.20.2 | SUSE-SU-2021:2673-1 |
| SUSE Manager Client Tools 12 | rhnlib | 4.2.4-21.34.2 | SUSE-SU-2021:2673-1 |
| SUSE Manager Client Tools 12 | spacecmd | 4.2.11-38.85.2 | SUSE-SU-2021:2673-1 |
| SUSE Manager Client Tools 12 | spacewalk-client-tools | 4.2.12-52.53.2 | SUSE-SU-2021:2673-1 |
| SUSE Manager Client Tools 12 | spacewalk-koan | 4.2.4-24.24.2 | SUSE-SU-2021:2673-1 |
| SUSE Manager Client Tools 12 | spacewalk-oscap | 4.2.2-19.18.2 | SUSE-SU-2021:2673-1 |
| SUSE Manager Client Tools 12 | suseRegisterInfo | 4.2.4-25.18.2 | SUSE-SU-2021:2673-1 |
| SUSE Manager Client Tools 12 | uyuni-common-libs | 4.2.5-1.15.2 | SUSE-SU-2021:2673-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | grafana | 7.5.7-1.2 | openSUSE-SU-2024:10818-1 |
| openSUSE Leap 15.3 | ansible | 2.9.21-1.5.1 | openSUSE-SU-2021:2675-1 |
| openSUSE Leap 15.3 | dracut-saltboot | 0.1.1627546504.96a0b3e-1.27.1 | openSUSE-SU-2021:2675-1 |
| openSUSE Leap 15.3 | grafana | 7.5.7-3.12.1 | openSUSE-SU-2021:2662-1 |
| openSUSE Leap 15.3 | mgr-cfg | 4.2.3-1.18.1 | openSUSE-SU-2021:2675-1 |
| openSUSE Leap 15.3 | mgr-custom-info | 4.2.2-1.12.1 | openSUSE-SU-2021:2675-1 |
| openSUSE Leap 15.3 | mgr-osad | 4.2.6-1.30.1 | openSUSE-SU-2021:2675-1 |
| openSUSE Leap 15.3 | mgr-push | 4.2.3-1.12.1 | openSUSE-SU-2021:2675-1 |
| openSUSE Leap 15.3 | mgr-virtualization | 4.2.2-1.20.1 | openSUSE-SU-2021:2675-1 |
| openSUSE Leap 15.3 | rhnlib | 4.2.4-3.28.1 | openSUSE-SU-2021:2675-1 |
| openSUSE Leap 15.3 | spacecmd | 4.2.11-3.62.1 | openSUSE-SU-2021:2675-1 |
| openSUSE Leap 15.3 | spacewalk-client-tools | 4.2.12-3.44.1 | openSUSE-SU-2021:2675-1 |
| openSUSE Leap 15.3 | spacewalk-koan | 4.2.4-3.21.1 | openSUSE-SU-2021:2675-1 |
| openSUSE Leap 15.3 | spacewalk-oscap | 4.2.2-3.12.1 | openSUSE-SU-2021:2675-1 |
| openSUSE Leap 15.3 | suseRegisterInfo | 4.2.4-3.15.1 | openSUSE-SU-2021:2675-1 |
| openSUSE Leap 15.3 | uyuni-common-libs | 4.2.5-1.15.1 | openSUSE-SU-2021:2675-1 |
| openSUSE Leap 15.2 | ansible | 2.9.21-lp152.2.7.1 | openSUSE-SU-2021:1162-1 |
| openSUSE Leap 15.2 | dracut-saltboot | 0.1.1627546504.96a0b3e-lp152.2.26.1 | openSUSE-SU-2021:1162-1 |
| openSUSE Leap 15.2 | golang-github-prometheus-prometheus | 2.27.1-lp152.3.13.1 | openSUSE-SU-2021:1162-1 |
| openSUSE Leap 15.2 | grafana | 7.5.7-lp152.2.16.1 | openSUSE-SU-2021:1148-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | grafana | 7.4.5-r0 | — |
| Alpine v3.23 | grafana | 7.4.5-r0 | — |
| Alpine v3.22 | grafana | 7.4.5-r0 | — |
| Alpine v3.21 | grafana | 7.4.5-r0 | — |
| Alpine v3.20 | grafana | 7.4.5-r0 | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | grafana | 7.4.5-r0 | — |
| Alpine v3.18 | grafana | 7.4.5-r0 | — |
| Alpine v3.17 | grafana | 7.4.5-r0 | — |
| Alpine v3.16 | grafana | 7.4.5-r0 | — |
| Alpine v3.15 | grafana | 7.4.5-r0 | — |
| Alpine v3.14 | grafana | 7.4.5-r0 | — |
Advisories 8
- SUSE-SU-2021:2660-1 Security update for grafana SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:2675-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10818-1 grafana-7.5.7-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:1148-1 Security update for grafana SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:2675-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:2673-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:2662-1 Security update for grafana SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:1162-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://community.grafana.com/t/release-notes-v6-7-x/27119
- https://community.grafana.com
- http://www.openwall.com/lists/oss-security/2021/03/19/5
- https://grafana.com/blog/2021/03/18/grafana-6.7.6-7.3.10-and-7.4.5-released-with-important-security-fixes-for-grafana-enterprise/
- https://community.grafana.com/t/grafana-enterprise-6-7-6-7-3-10-and-7-4-5-security-update/44724
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-5/