CVE-2022-39201: Data source and plugin proxy endpoints could leak the authentication cookie to some destination plugins

Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain conditions.

Affected versions: Grafana <= 9.1.x

An IDOR (Insecure Direct Object Reference) vulnerability was found on Grafana Teams APIs. This flaw impacts the /teams/:teamId, /teams/:search, /teams/:teamId/members API endpoints and may allow an authenticated attacker to view unintended data by querying for the specific team ID or search for teams and see the total number of available teams (including for those teams where the user does not have access to).

GitHub security advisory: https://github.com/grafana/grafana/security/advisories/GHSA-63g3-9jq3-mccv

Grafana blog post: https://grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/