CVE-2024-9476

Privilege escalation vulnerability for Organizations in Grafana

State: Published
Severity: 5.1 Medium
Published: Nov 13, 2024
Updated: Nov 23, 2025
Reserved: Oct 3, 2024

Description

A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizations feature to isolate resources on their Grafana instance.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	GRAFANA

Weaknesses

CWE-266

Affected Products

Product	Versions
Grafana OSS and EnterpriseGrafana Labs	11.3.0 to before 11.3.0+security-01Affected 11.2.0 to before 11.2.3+security-01Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.