PkgSeer

Vulnerability GHSA-p5x9-j974-rpfp

Low Risk

5 months ago

Grafana legacy correlations allow cross-tenant disclosure and deletion

v0.0.0-cloud - v1.9.1

Summary

Grafana legacy correlations allow cross-tenant disclosure and deletion

Details

A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4.

Thanks to Gyu-hyeok Lee (g2h) for reporting this vulnerability.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Grafana: Pre-authentication denial of service in the public dashboard query handler in github.com/grafana/grafana

v0.0.1-test - v6.1.6+incompatible GO-2026-6541

Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug in github.com/grafana/grafana

v0.0.1-test - v6.1.6+incompatible GO-2026-6542

Grafana Loki datasource plugin's callResource handler contains a path traversal vulnerability. in github.com/grafana/grafana

v0.0.1-test - v6.1.6+incompatible GO-2026-6544

Grafana: Path traversal in the Tempo and Loki data source plugins in github.com/grafana/grafana

v0.0.1-test - v6.1.6+incompatible GO-2026-6545

Grafana: Users can generate Service Account tokens after permissions removal in github.com/grafana/grafana

v0.0.1-test - v6.1.6+incompatible GO-2026-5708

View all vulnerabilities for these packages

Impacted packages

github.com/grafana/grafana

Timeline

Published

5 months ago

Last Modified

8 hours ago