UpHeron
All vulnerabilities

Servers and applications

CVE-2022-21713

CVE-2022-21713: Grafana Teams API IDOR

Severity
Medium 4.3
Published
8 Feb 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
7.5.15, 8.3.5
Also known as
GHSA-63g3-9jq3-mccv
Sources
NVD, Project advisories (GitHub)

Description

Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view unintended data by querying for the specific team ID, `/teams/:search` will allow an authenticated attacker to search for teams and see the total number of…

Affected software

SoftwareAffected versions
GrafanaServers and applications · cpe:a:grafana:grafana
  • From 8.0.0 before 8.3.5
  • From 5.0.0 before 7.5.15
  • Version 5.0.0-beta5
  • Version 5.0.0-beta4
All 7 release lines
  • Version 5.0.0-beta1
  • Version 5.0.0-beta2
  • Version 5.0.0-beta3
  • Version 5.0.0-beta4
  • Version 5.0.0-beta5
  • From 5.0.0 before 7.5.15
  • From 8.0.0 before 8.3.5
GrafanaServers and applications · github:grafana/grafana
  • From 5.0.0-beta1 before 7.5.15

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-21713
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-21713
  • GitHub Advisory Database https://github.com/advisories/GHSA-63g3-9jq3-mccv
  • github.com https://github.com/grafana/grafana/security/advisories/GHSA-63g3-9jq3-mccv