Servers and applications
CVE-2021-28146
The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service, this vulnerability allows any authenticated user to add external groups to existing teams. This can be used to grant a user team permissions that the user isn't supposed to have.
- Severity
- Medium 6.5
- Published
- 22 Mar 2021
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 7.4.5
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
GrafanaServers and applications · cpe:a:grafana:grafana |
|