CVE-2024-6322

State: Published
Severity: 4.4 Medium
Published: Aug 20, 2024
Updated: Nov 23, 2025
Reserved: Jun 25, 2024

Description

Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.

Scores

CVSS	Score	Vector	Source
3.1	4.4 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L	GRAFANA

Weaknesses

CWE-266

Affected Products

Product	Versions
GrafanaGrafana	11.1.0 to before 11.1.1Affected 11.1.2 to before 11.1.3Affected
Grafana EnterpriseGrafana	11.1.0 to before 11.1.1Affected 11.1.2 to before 11.1.3Affected

References

https://grafana.com/security/security-advisories/cve-2024-6322/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.