CVE-2023-4822: High severity Grafana Grafana vulnerability

Grafana is an open-source platform for monitoring and observability. The vulnerability impacts instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations.

It also allows an Organization Admin to assign or revoke any permissions that they have to any user globally.

This means that any Organization Admin can elevate their own permissions in any organization that they are already a member of, or elevate or restrict the permissions of any other user.

The vulnerability does not allow a user to become a member of an organization that they are not already a member of, or to add any other users to an organization that the current user is not a member of.

Grafana is incorrectly assessing permissions to update global roles and role assignments, therefore users with administrator permissions in one organization can change global role permissions and global role assignments.

The CVSS score for this vulnerability is 6.7 Medium. Impact If exploited, an attacker who has the Organization Admin role in any organization can elevate their permissions across all organizations, elevate other users’ permissions in all organizations or limit other users’ permissions in all organizations.

The vulnerability does not allow the attacker to become a member of an organization that they are not already a member of, or to add any other user to an organization that the attacker is not a member of.

Potentially breaking changes and resolution explanation

We now require users to be Grafana server administrators in order to update global roles and global role assignments. If you were relying on organization administrators being able to do that, you will now also need to grant Grafana server administrator privileges to them.

Impacted versions

Grafana 8.0.0 to Grafana 10.0.0 with RBAC enabled, and Grafana 10.0.0 - Grafana 10.1.1. Only Grafana enterprise instances with more than one organization are vulnerable. You can check if RBAC is enabled by calling GET /api/access-control/status.

— Red Hat