What’s Vulnerable › Vulnerabilities

CVE-2024-9476: Privilege escalation vulnerability for Organizations in Grafana

• Severity: medium (CVSS 5.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-13 · updated 2026-06-17
• Weakness: CWE-266

Description

A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizations feature to isolate resources on their Grafana instance.

Affected products

• Grafana Labs Grafana OSS and Enterprise: from 11.3.0 before 11.3.0+security-01; from 11.2.0 before 11.2.3+security-01 — fixed in 11.2.3+security-01, 11.3.0+security-01

How to fix

Upgrade to a fixed version: Grafana Labs Grafana OSS and Enterprise 11.2.3+security-01, 11.3.0+security-01. Check the vendor advisory for mitigations.

References

• https://grafana.com/blog/2024/11/12/grafana-security-release-medium-severity-security-fix-for-cve-2024-9476/
• https://grafana.com/security/security-advisories/cve-2024-9476/

Get alerted when CVE-2024-9476 or the next vulnerability affects your stack