Skip to content
OpenAdvisories
High · 7.6 CVE-2022-36062 BIT-grafana-2022-36062EUVD-2024-1710GHSA-p978-56hq-r492GO-2024-2854

Grafana folders admin only permission privilege escalation

Published Sep 22, 2022 · Updated Nov 3, 2026 · Assigned by GitHub_M

Vendor: Grafana Product: Grafana Package: github.com/grafana/grafana Package: grafana Package: grafana Category: Web / CMS Ecosystem: Alpine Ecosystem: Go Ecosystem: Ubuntu

Description

Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation of Permissions resulting in privilege escalation on some folders where Admin is the only used permission. The vulnerability impacts Grafana instances where RBAC was disabled and enabled afterwards, as the migrations which are translating legacy folder permissions to RBAC permissions do not account for the scenario where the only user permission in the folder is Admin, as a result RBAC adds permissions for Editors and Viewers which allow them to edit and view folders accordingly. This issue has been patched in versions 8.5.13, 9.0.9, and 9.1.6. A workaround when the impacted folder/dashboard is known is to remove the additional permissions manually.

Affected products

VendorProductAffectedFixed
grafana grafana < 8.5.13, >= 9.0.0, < 9.0.9, >= 9.1.0, < 9.1.6 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS grafana No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 grafana 9.5.1-150200.3.41.3 SUSE-SU-2023:2575-1
SLES 15 SP4 grafana 8.5.13-150200.3.29.5 SUSE-SU-2023:2575-1, SUSE-SU-2022:4428-1
SLES 15 SP2 bind 9.16.6-150000.12.65.1 SUSE-SU-2023:2578-1
SLES 15 SP1 bind 9.16.6-150000.12.65.1 SUSE-SU-2023:2578-1
Show 12 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP2 bind 9.16.6-150000.12.65.1 SUSE-SU-2023:2578-1
SLES for SAP 15 SP1 bind 9.16.6-150000.12.65.1 SUSE-SU-2023:2578-1
SLE HPC 15 SP2 bind 9.16.6-150000.12.65.1 SUSE-SU-2023:2578-1
SLE HPC 15 SP1 bind 9.16.6-150000.12.65.1 SUSE-SU-2023:2578-1
SUSE Manager Proxy Module 4.3 golang-github-boynux-squid_exporter 1.6-150000.1.9.1 SUSE-SU-2022:4437-1
SUSE Manager Proxy Module 4.3 prometheus-blackbox_exporter 0.19.0-150000.1.14.3 SUSE-SU-2022:4437-1
SUSE Manager Proxy Module 4.3 zypp-plugin-spacewalk 1.0.14-150000.3.35.1 SUSE-SU-2023:2578-1
SUSE Manager Proxy Module 4.2 golang-github-boynux-squid_exporter 1.6-150000.1.9.1 SUSE-SU-2022:4437-1
SUSE Manager Proxy Module 4.2 prometheus-blackbox_exporter 0.19.0-150000.1.14.3 SUSE-SU-2022:4437-1
SUSE Manager Proxy Module 4.2 zypp-plugin-spacewalk 1.0.14-150000.3.35.1 SUSE-SU-2023:2578-1
SUSE Manager Client Tools for SLE Micro 5 bind 9.16.6-150000.12.65.1 SUSE-SU-2023:2578-1
SUSE Manager Client Tools for SLE Micro 5 dracut-saltboot 0.1.1665997480.587fa10-150000.1.41.1 SUSE-SU-2023:2578-1, SUSE-SU-2022:4437-1
SUSE Manager Client Tools for SLE Micro 5 prometheus-blackbox_exporter 0.19.0-150000.1.14.3 SUSE-SU-2022:4437-1
SUSE Manager Client Tools for SLE Micro 5 uyuni-proxy-systemd-services 4.3.7-150000.1.9.3 SUSE-SU-2022:4437-1
SUSE Manager Client Tools Beta for SLE Micro 5 dracut-saltboot 0.1.1681904360.84ef141-159000.3.30.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5 golang-github-QubitProducts-exporter_exporter 0.4.0-159000.4.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5 prometheus-blackbox_exporter 0.24.0-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5 uyuni-proxy-systemd-services 5.0.1-159000.3.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 ansible 2.9.27-159000.3.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 dracut-saltboot 0.1.1665997480.587fa10-150000.1.41.1 SUSE-SU-2024:0196-1, SUSE-SU-2023:2578-1, SUSE-SU-2022:4437-1
SUSE Manager Client Tools 15 golang-github-QubitProducts-exporter_exporter 0.4.0-159000.4.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 golang-github-boynux-squid_exporter 1.6-150000.1.9.1 SUSE-SU-2024:0196-1, SUSE-SU-2022:4437-1
SUSE Manager Client Tools 15 golang-github-lusitaniae-apache_exporter 1.0.0-159000.4.12.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 golang-github-prometheus-prometheus 2.45.0-159000.6.33.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 grafana 8.5.13-150000.1.36.3 SUSE-SU-2024:0196-1, SUSE-SU-2023:2578-1, SUSE-SU-2022:4437-1
SUSE Manager Client Tools 15 mgr-daemon 4.3.7-150000.1.41.1 SUSE-SU-2023:2578-1
SUSE Manager Client Tools 15 mgr-push 5.0.1-159000.4.21.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 prometheus-blackbox_exporter 0.19.0-150000.1.14.3 SUSE-SU-2024:0196-1, SUSE-SU-2022:4437-1
SUSE Manager Client Tools 15 prometheus-postgres_exporter 0.10.1-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 python-hwdata 2.3.5-159000.5.13.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 python-pyvmomi 6.7.3-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 rhnlib 5.0.1-159000.6.30.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 spacecmd 4.3.16-150000.3.89.1 SUSE-SU-2024:0196-1, SUSE-SU-2023:2578-1, SUSE-SU-2022:4437-1
SUSE Manager Client Tools 15 spacewalk-client-tools 4.3.13-150000.3.71.3 SUSE-SU-2024:0196-1, SUSE-SU-2022:4437-1
SUSE Manager Client Tools 15 supportutils-plugin-salt 1.2.2-159000.5.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 supportutils-plugin-susemanager-client 5.0.1-159000.6.15.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 uyuni-common-libs 4.3.8-150000.1.33.1 SUSE-SU-2024:0196-1, SUSE-SU-2023:2578-1
SUSE Manager Client Tools 15 uyuni-proxy-systemd-services 4.3.7-150000.1.9.3 SUSE-SU-2024:0196-1, SUSE-SU-2022:4437-1
SUSE Manager Client Tools 15 zypp-plugin-spacewalk 1.0.14-150000.3.35.1 SUSE-SU-2023:2578-1
SUSE Manager Client Tools 12 golang-github-QubitProducts-exporter_exporter 0.4.0-4.6.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-boynux-squid_exporter 1.6-1.9.1 SUSE-SU-2024:0191-1, SUSE-SU-2022:4439-1
SUSE Manager Client Tools 12 golang-github-lusitaniae-apache_exporter 1.0.0-4.12.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-alertmanager 0.26.0-4.12.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-node_exporter 1.5.0-4.15.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-prometheus 2.45.0-4.33.3 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-promu 0.14.0-4.12.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 grafana 8.5.13-1.36.2 SUSE-SU-2024:0191-1, SUSE-SU-2023:2579-1, SUSE-SU-2022:4439-1
SUSE Manager Client Tools 12 kiwi-desc-saltboot 0.1.1687520761.cefb248-4.15.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 mgr-daemon 4.3.7-1.41.1 SUSE-SU-2023:2579-1
SUSE Manager Client Tools 12 mgr-push 5.0.1-4.21.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 prometheus-blackbox_exporter 0.19.0-1.14.1 SUSE-SU-2024:0191-1, SUSE-SU-2022:4439-1
SUSE Manager Client Tools 12 prometheus-postgres_exporter 0.10.1-3.6.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 python-hwdata 2.3.5-15.12.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 rhnlib 5.0.1-24.30.3 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 spacecmd 4.3.16-38.112.1 SUSE-SU-2024:0191-1, SUSE-SU-2023:2579-1, SUSE-SU-2022:4439-1
SUSE Manager Client Tools 12 spacewalk-client-tools 4.3.13-52.80.1 SUSE-SU-2022:4439-1
SUSE Manager Client Tools 12 supportutils-plugin-salt 1.2.2-9.9.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 supportutils-plugin-susemanager-client 5.0.1-9.15.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 system-user-grafana +1 1.0.0-3.7.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 uyuni-common-libs 4.3.8-1.33.1 SUSE-SU-2024:0191-1, SUSE-SU-2023:2579-1
SUSE Manager Client Tools 12 zypp-plugin-spacewalk 1.0.14-30.42.1 SUSE-SU-2023:2579-1
SUSE Enterprise Storage 7 bind 9.16.6-150000.12.65.1 SUSE-SU-2023:2578-1
SUSE Enterprise Storage 6 grafana 8.5.13-150100.3.12.1 SUSE-SU-2022:3676-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed grafana 8.5.13-1.1 openSUSE-SU-2024:12366-1
openSUSE Leap 15.5 dracut-saltboot 0.1.1681904360.84ef141-150000.1.50.1 SUSE-SU-2023:2578-1
openSUSE Leap 15.5 grafana 9.5.1-150200.3.41.3 SUSE-SU-2023:2575-1
openSUSE Leap 15.5 spacecmd 4.3.21-150000.3.98.1 SUSE-SU-2023:2578-1
openSUSE Leap 15.5 wire 0.5.0-150000.1.12.3 SUSE-SU-2023:2578-1
openSUSE Leap 15.4 bind 9.16.6-150000.12.65.1 SUSE-SU-2023:2578-1
openSUSE Leap 15.4 dracut-saltboot 0.1.1665997480.587fa10-150000.1.41.1 SUSE-SU-2023:2578-1, SUSE-SU-2022:4437-1
openSUSE Leap 15.4 golang-github-boynux-squid_exporter 1.6-150000.1.9.1 SUSE-SU-2022:4437-1
openSUSE Leap 15.4 golang-github-prometheus-promu 0.13.0-150000.3.9.1 SUSE-SU-2022:4437-1
openSUSE Leap 15.4 grafana 8.5.13-150200.3.29.5 SUSE-SU-2023:2575-1, SUSE-SU-2022:4428-1
openSUSE Leap 15.4 prometheus-blackbox_exporter 0.19.0-150000.1.14.3 SUSE-SU-2022:4437-1
openSUSE Leap 15.4 spacecmd 4.3.16-150000.3.89.1 SUSE-SU-2023:2578-1, SUSE-SU-2022:4437-1
openSUSE Leap 15.4 wire 0.5.0-150000.1.9.3 SUSE-SU-2023:2578-1, SUSE-SU-2022:4437-1
openSUSE Leap 15.3 dracut-saltboot 0.1.1665997480.587fa10-150000.1.41.1 SUSE-SU-2022:4437-1
openSUSE Leap 15.3 golang-github-boynux-squid_exporter 1.6-150000.1.9.1 SUSE-SU-2022:4437-1
openSUSE Leap 15.3 golang-github-prometheus-promu 0.13.0-150000.3.9.1 SUSE-SU-2022:4437-1
openSUSE Leap 15.3 grafana 8.5.13-150200.3.29.5 SUSE-SU-2022:4428-1
openSUSE Leap 15.3 spacecmd 4.3.16-150000.3.89.1 SUSE-SU-2022:4437-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.16 grafana 8.5.13-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/grafana/grafana >= 8.5.0, < 8.5.13 8.5.13 GHSA-p978-56hq-r492
Go github.com/grafana/grafana >= 9.0.0, < 9.0.9 9.0.9 GHSA-p978-56hq-r492
Go github.com/grafana/grafana >= 9.1.0, < 9.1.6 9.1.6 GHSA-p978-56hq-r492
Go github.com/grafana/grafana all versions — GO-2024-2854

Advisories 11

References