UpHeron
All vulnerabilities

Servers and applications

CVE-2021-41244

Fine-grained access control enables organization admins to create/modify/delete user roles in other organization

Severity
High 7.2
Published
15 Nov 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
8.2.4
Also known as
GHSA-mpwp-42x6-4wmx
Sources
NVD, Project advisories (GitHub)

Description

Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance admins are able to access users from other organizations. Grafana 8.0 introduced a mechanism which allowed users with the Organization Admin role to list, add, remove, and update…

Affected software

SoftwareAffected versions
GrafanaServers and applications · cpe:a:grafana:grafana
  • From 8.0.0 before 8.2.4
GrafanaServers and applications · github:grafana/grafana
  • From 8.0.0 before 8.2.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-41244
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-41244
  • GitHub Advisory Database https://github.com/advisories/GHSA-mpwp-42x6-4wmx
  • github.com https://github.com/grafana/grafana/security/advisories/GHSA-mpwp-42x6-4wmx