What’s Vulnerable › Vulnerabilities
CVE-2024-6322
- Severity: medium (CVSS 5.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-08-20 · updated 2026-06-17
- Weakness: CWE-266
Description
Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.
Affected products
- Grafana: from 11.1.0 before 11.1.1; from 11.1.2 before 11.1.3 — fixed in 11.1.1, 11.1.3
How to fix
Upgrade to a fixed version: Grafana 11.1.1, 11.1.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-6322 or the next vulnerability affects your stack