Description
A user changing their email after signing up and verifying it can change it without verification in profile settings.
The configuration option "verify_email_enabled" will only validate email only on sign up.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana | 2.5.0 – < 9.5.16, 10.0.0 – < 10.0.11, 10.1.0 – < 10.1.7, 10.2.0 – < 10.2.4, 10.3.0 – < 10.3.3 | 9.5.16 |
| Grafana | Grafana Enterprise | 2.5.0 – < 9.5.16, 10.0.0 – < 10.0.11, 10.1.0 – < 10.1.7, 10.2.0 – < 10.2.4, 10.3.0 – < 10.3.3 | 9.5.16 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | grafana | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | golang-github-prometheus-promu | 0.17.0-150000.3.24.1 | SUSE-SU-2025:0525-1 |
| SLES 15 SP6 | grafana | 9.5.18-150200.3.56.1 | SUSE-SU-2025:0545-1, SUSE-SU-2024:1530-2 |
| SLES 15 SP6 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SLES 15 SP5 | golang-github-prometheus-promu | 0.14.0-150000.3.18.2 | SUSE-SU-2024:1509-1 |
| SLES 15 SP5 | grafana | 9.5.18-150200.3.56.1 | SUSE-SU-2024:1530-1 |
| SLES 15 SP5 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SLES 15 SP4 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SLES 15 SP3 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SLES 12 SP5 | golang-github-prometheus-node_exporter | 1.7.0-1.30.2 | SUSE-SU-2024:1508-1 |
Show 15 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SLES for SAP 15 SP4 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SLES for SAP 15 SP3 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SLES for SAP 12 SP5 | golang-github-prometheus-node_exporter | 1.7.0-1.30.2 | SUSE-SU-2024:1508-1 |
| SLE HPC 15 SP5 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SLE HPC 15 SP4 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SLE HPC 15 SP3 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SUSE Manager Server 4.3 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SUSE Manager Proxy Module 4.3 | ansible | 2.9.27-150000.1.17.2 | SUSE-SU-2024:1509-1 |
| SUSE Manager Proxy Module 4.3 | uyuni-proxy-systemd-services | 4.3.12-150000.1.21.2 | SUSE-SU-2024:1509-1 |
| SUSE Manager Proxy 4.3 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SUSE Manager Client Tools for SLE Micro 5 | dracut-saltboot | 0.1.1710765237.46af599-150000.1.53.2 | SUSE-SU-2025:0525-1, SUSE-SU-2024:1509-1 |
| SUSE Manager Client Tools for SLE Micro 5 | uyuni-proxy-systemd-services | 4.3.12-150000.1.21.2 | SUSE-SU-2024:1509-1 |
| SUSE Manager Client Tools for SLE Micro 5 | uyuni-tools | 0.1.28-150000.1.16.1 | SUSE-SU-2025:0525-1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | golang-github-prometheus-node_exporter | 1.5.0-159000.6.2.1 | SUSE-SU-2024:1427-1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | uyuni-tools | 0.1.7-159000.3.8.1 | SUSE-SU-2024:1427-1 |
| SUSE Manager Client Tools 15 | POS_Image-JeOS7 +1 | 0.1.1710765237.46af599-150000.1.21.2 | SUSE-SU-2024:1509-1, SUSE-SU-2024:1427-1 |
| SUSE Manager Client Tools 15 | ansible | 2.9.27-150000.1.17.2 | SUSE-SU-2024:1509-1, SUSE-SU-2024:1427-1 |
| SUSE Manager Client Tools 15 | dracut-saltboot | 0.1.1710765237.46af599-150000.1.53.2 | SUSE-SU-2025:0525-1, SUSE-SU-2024:1509-1, SUSE-SU-2024:1427-1 |
| SUSE Manager Client Tools 15 | golang-github-prometheus-prometheus | 2.53.3-150000.3.59.1 | SUSE-SU-2025:0525-1 |
| SUSE Manager Client Tools 15 | grafana | 9.5.16-159000.4.30.2 | SUSE-SU-2025:0525-1, SUSE-SU-2024:1509-1, SUSE-SU-2024:1427-1 |
| SUSE Manager Client Tools 15 | mgr-daemon | 4.3.9-150000.1.47.2 | SUSE-SU-2024:1509-1 |
| SUSE Manager Client Tools 15 | spacecmd | 4.3.27-150000.3.116.2 | SUSE-SU-2025:0525-1, SUSE-SU-2024:1509-1, SUSE-SU-2024:1427-1 |
| SUSE Manager Client Tools 15 | spacewalk-client-tools | 4.3.19-150000.3.89.2 | SUSE-SU-2024:1509-1, SUSE-SU-2024:1427-1 |
| SUSE Manager Client Tools 15 | spacewalk-koan | 4.3.6-150000.3.33.2 | SUSE-SU-2024:1509-1 |
| SUSE Manager Client Tools 15 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| SUSE Manager Client Tools 15 | supportutils-plugin-susemanager-client | 5.0.3-159000.6.21.2 | SUSE-SU-2025:0525-1, SUSE-SU-2024:1427-1 |
| SUSE Manager Client Tools 15 | uyuni-common-libs | 4.3.10-150000.1.39.2 | SUSE-SU-2024:1509-1 |
| SUSE Manager Client Tools 15 | uyuni-proxy-systemd-services | 4.3.12-150000.1.21.2 | SUSE-SU-2024:1509-1 |
| SUSE Manager Client Tools 15 | uyuni-tools | 0.1.7-159000.3.8.1 | SUSE-SU-2025:0525-1, SUSE-SU-2024:1427-1 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-alertmanager | 0.26.0-1.27.2 | SUSE-SU-2024:1508-1, SUSE-SU-2024:1419-1 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-node_exporter | 1.7.0-1.30.2 | SUSE-SU-2024:1508-1, SUSE-SU-2024:1419-1 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-prometheus | 2.53.3-1.56.1 | SUSE-SU-2025:0524-1 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-promu | 0.14.0-1.18.1 | SUSE-SU-2025:0524-1, SUSE-SU-2024:1508-1, SUSE-SU-2024:1419-1 |
| SUSE Manager Client Tools 12 | grafana | 9.5.16-4.27.1 | SUSE-SU-2025:0524-1, SUSE-SU-2024:1508-1, SUSE-SU-2024:1419-1 |
| SUSE Manager Client Tools 12 | mgr-daemon | 4.3.9-1.47.1 | SUSE-SU-2024:1508-1 |
| SUSE Manager Client Tools 12 | spacecmd | 4.3.27-38.139.1 | SUSE-SU-2025:0524-1, SUSE-SU-2024:1508-1, SUSE-SU-2024:1419-1 |
| SUSE Manager Client Tools 12 | spacewalk-client-tools | 4.3.19-52.98.1 | SUSE-SU-2024:1508-1, SUSE-SU-2024:1419-1 |
| SUSE Manager Client Tools 12 | spacewalk-koan | 4.3.6-24.36.1 | SUSE-SU-2024:1508-1 |
| SUSE Manager Client Tools 12 | supportutils-plugin-salt | 1.2.3-6.25.1 | SUSE-SU-2025:0524-1 |
| SUSE Manager Client Tools 12 | supportutils-plugin-susemanager-client | 5.0.3-9.21.1 | SUSE-SU-2025:0524-1, SUSE-SU-2024:1419-1 |
| SUSE Manager Client Tools 12 | uyuni-common-libs | 4.3.10-1.39.1 | SUSE-SU-2024:1508-1 |
| SUSE Manager Client Tools 12 | uyuni-tools | 0.1.7-3.8.1 | SUSE-SU-2025:0524-1, SUSE-SU-2024:1419-1 |
| SUSE Enterprise Storage 7.1 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | grafana | 10.1.7-1.1 | openSUSE-SU-2024:13713-1 |
| openSUSE Leap 15.6 | dracut-saltboot | 0.1.1728559936.c16d4fb-150000.1.56.1 | SUSE-SU-2025:0525-1 |
| openSUSE Leap 15.6 | golang-github-prometheus-promu | 0.17.0-150000.3.24.1 | SUSE-SU-2025:0525-1 |
| openSUSE Leap 15.6 | grafana | 9.5.18-150200.3.56.1 | SUSE-SU-2025:0545-1, SUSE-SU-2024:1530-2 |
| openSUSE Leap 15.6 | mybatis | 3.5.6-150200.5.6.1 | SUSE-SU-2024:1530-2 |
| openSUSE Leap 15.6 | spacecmd | 5.0.11-150000.3.130.1 | SUSE-SU-2025:0525-1 |
| openSUSE Leap 15.6 | supportutils-plugin-salt | 1.2.3-150000.3.16.1 | SUSE-SU-2025:0525-1 |
| openSUSE Leap 15.6 | supportutils-plugin-susemanager-client | 5.0.4-150000.3.27.1 | SUSE-SU-2025:0525-1 |
| openSUSE Leap 15.5 | POS_Image-JeOS7 +1 | 0.1.1710765237.46af599-150000.1.21.2 | SUSE-SU-2024:1509-1 |
| openSUSE Leap 15.5 | ansible | 2.9.27-150000.1.17.2 | SUSE-SU-2024:1509-1 |
| openSUSE Leap 15.5 | dracut-saltboot | 0.1.1710765237.46af599-150000.1.53.2 | SUSE-SU-2024:1509-1 |
| openSUSE Leap 15.5 | golang-github-prometheus-promu | 0.14.0-150000.3.18.2 | SUSE-SU-2024:1509-1 |
| openSUSE Leap 15.5 | grafana | 9.5.18-150200.3.56.1 | SUSE-SU-2024:1530-1 |
| openSUSE Leap 15.5 | mybatis | 3.5.6-150200.5.6.1 | SUSE-SU-2024:1530-1 |
| openSUSE Leap 15.5 | spacecmd | 4.3.27-150000.3.116.2 | SUSE-SU-2024:1509-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/grafana/grafana | >= 2.5.0, < 9.5.16 | 9.5.16 | GHSA-3hv4-r2fm-h27f |
| Go | github.com/grafana/grafana | >= 10.0.0, < 10.0.11 | 10.0.11 | GHSA-3hv4-r2fm-h27f |
| Go | github.com/grafana/grafana | >= 10.1.0, < 10.1.7 | 10.1.7 | GHSA-3hv4-r2fm-h27f |
| Go | github.com/grafana/grafana | >= 10.2.0, < 10.2.4 | 10.2.4 | GHSA-3hv4-r2fm-h27f |
| Go | github.com/grafana/grafana | >= 10.3.0, < 10.3.3 | 10.3.3 | GHSA-3hv4-r2fm-h27f |
Advisories 11
- SUSE-SU-2025:0524-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1508-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1509-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0545-1 Security update for grafana SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:0525-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1530-1 Security update for grafana and mybatis SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1419-1 Security Beta update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1530-2 Security update for grafana and mybatis SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:1427-1 Security Beta update for SUSE Manager Client Tools and Salt SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13713-1 grafana-10.1.7-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2024-0358 Grafana: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Feb 13, 2025