Skip to content
OpenAdvisories
Medium · 6.4 CVE-2022-39306 BIT-grafana-2022-39306EUVD-2024-1372GHSA-2x6g-h2hg-rq84GO-2024-2843

Grafana contains Improper Input Validation

Published Nov 9, 2022 · Updated Jan 28, 2026 · Assigned by GitHub_M

Vendor: Grafana Product: Grafana Package: github.com/grafana/grafana Package: grafana Category: Web / CMS Ecosystem: Go Ecosystem: Ubuntu

Description

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins add members to the organization, non existing users get an email invite, existing members are added directly to the organization. When an invite link is sent, it allows users to sign up with whatever username/email address the user chooses and become a member of the organization. This introduces a vulnerability which can be used with malicious intent. This issue is patched in version 9.2.4, and has been backported to 8.5.15. There are no known workarounds.

Affected products

VendorProductAffectedFixed
grafana grafana < 8.5.15, >= 9.v9.0.0-beta1, < 9.2.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS grafana No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 grafana 9.2.10-7.el9_3 RHSA-2023:6420

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 grafana 9.2.10-7.el9_3.alma.1 ALSA-2023:6420

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 grafana 8.5.15-150200.3.32.1 SUSE-SU-2023:0362-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Manager Client Tools for SLE Micro 5 dracut-saltboot 0.1.1673279145.e7616bd-150000.1.44.1 SUSE-SU-2023:0353-1
SUSE Manager Client Tools Beta for SLE Micro 5 dracut-saltboot 0.1.1681904360.84ef141-159000.3.30.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5 golang-github-QubitProducts-exporter_exporter 0.4.0-159000.4.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5 prometheus-blackbox_exporter 0.24.0-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools Beta for SLE Micro 5 uyuni-proxy-systemd-services 5.0.1-159000.3.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 ansible 2.9.27-159000.3.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 dracut-saltboot 0.1.1673279145.e7616bd-150000.1.44.1 SUSE-SU-2024:0196-1, SUSE-SU-2023:0353-1
SUSE Manager Client Tools 15 golang-github-QubitProducts-exporter_exporter 0.4.0-159000.4.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 golang-github-boynux-squid_exporter 1.6-159000.4.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 golang-github-lusitaniae-apache_exporter 1.0.0-159000.4.12.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 golang-github-prometheus-prometheus 2.45.0-159000.6.33.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 grafana 8.5.15-150000.1.39.1 SUSE-SU-2024:0196-1, SUSE-SU-2023:0353-1
SUSE Manager Client Tools 15 mgr-osad 4.3.7-150000.1.42.1 SUSE-SU-2023:0353-1
SUSE Manager Client Tools 15 mgr-push 4.3.5-150000.1.24.2 SUSE-SU-2024:0196-1, SUSE-SU-2023:0353-1
SUSE Manager Client Tools 15 prometheus-blackbox_exporter 0.24.0-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 prometheus-postgres_exporter 0.10.1-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 python-hwdata 2.3.5-159000.5.13.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 python-pyvmomi 6.7.3-159000.3.6.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 rhnlib 4.3.5-150000.3.40.1 SUSE-SU-2024:0196-1, SUSE-SU-2023:0353-1
SUSE Manager Client Tools 15 spacecmd 4.3.18-150000.3.92.1 SUSE-SU-2024:0196-1, SUSE-SU-2023:0353-1
SUSE Manager Client Tools 15 spacewalk-client-tools 4.3.14-150000.3.74.1 SUSE-SU-2024:0196-1, SUSE-SU-2023:0353-1
SUSE Manager Client Tools 15 supportutils-plugin-salt 1.2.2-159000.5.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 supportutils-plugin-susemanager-client 5.0.1-159000.6.15.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 15 uyuni-common-libs 4.3.7-150000.1.30.1 SUSE-SU-2024:0196-1, SUSE-SU-2023:0353-1
SUSE Manager Client Tools 15 uyuni-proxy-systemd-services 5.0.1-159000.3.9.1 SUSE-SU-2024:0196-1
SUSE Manager Client Tools 12 golang-github-QubitProducts-exporter_exporter 0.4.0-4.6.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-boynux-squid_exporter 1.6-4.9.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-lusitaniae-apache_exporter 1.0.0-4.12.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-alertmanager 0.26.0-4.12.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-node_exporter 1.5.0-4.15.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-prometheus 2.45.0-4.33.3 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 golang-github-prometheus-promu 0.14.0-4.12.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 grafana 8.5.15-1.39.1 SUSE-SU-2024:0191-1, SUSE-SU-2023:0352-1
SUSE Manager Client Tools 12 kiwi-desc-saltboot 0.1.1673279145.e7616bd-1.32.1 SUSE-SU-2024:0191-1, SUSE-SU-2023:0352-1
SUSE Manager Client Tools 12 mgr-osad 4.3.7-1.42.1 SUSE-SU-2023:0352-1
SUSE Manager Client Tools 12 mgr-push 4.3.5-1.24.1 SUSE-SU-2024:0191-1, SUSE-SU-2023:0352-1
SUSE Manager Client Tools 12 prometheus-blackbox_exporter 0.24.0-3.6.3 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 prometheus-postgres_exporter 0.10.1-3.6.4 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 python-hwdata 2.3.5-15.12.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 rhnlib 4.3.5-21.46.1 SUSE-SU-2024:0191-1, SUSE-SU-2023:0352-1
SUSE Manager Client Tools 12 spacecmd 4.3.18-38.115.1 SUSE-SU-2024:0191-1, SUSE-SU-2023:0352-1
SUSE Manager Client Tools 12 spacewalk-client-tools 4.3.14-52.83.1 SUSE-SU-2023:0352-1
SUSE Manager Client Tools 12 supportutils-plugin-salt 1.2.2-9.9.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 supportutils-plugin-susemanager-client 5.0.1-9.15.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 system-user-grafana +1 1.0.0-3.7.2 SUSE-SU-2024:0191-1
SUSE Manager Client Tools 12 uyuni-common-libs 4.3.7-1.30.1 SUSE-SU-2024:0191-1, SUSE-SU-2023:0352-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed grafana 8.5.15-2.1 openSUSE-SU-2024:12564-1
openSUSE Leap 15.4 dracut-saltboot 0.1.1673279145.e7616bd-150000.1.44.1 SUSE-SU-2023:0353-1
openSUSE Leap 15.4 grafana 8.5.15-150200.3.32.1 SUSE-SU-2023:0362-1
openSUSE Leap 15.4 spacecmd 4.3.18-150000.3.92.1 SUSE-SU-2023:0353-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 grafana 9.2.10-7.el9_3 ELSA-2023-6420

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/grafana/grafana >= 8.0.0, < 8.5.15 8.5.15 GHSA-2x6g-h2hg-rq84
Go github.com/grafana/grafana >= 9.0.0, < 9.2.4 9.2.4 GHSA-2x6g-h2hg-rq84
Go github.com/grafana/grafana all versions — GO-2024-2843

Advisories 10

References