UpHeron
All vulnerabilities

Servers and applications

CVE-2022-36062

Grafana folders admin only permission privilege escalation

Severity
Low 3.8
Published
20 Sept 2022
Last changed
3 Nov 2026
Added to UpHeron
1 Nov 2026
Fixed in
8.5.13, 9.0.9, 9.1.6
Also known as
GHSA-p978-56hq-r492
Sources
NVD, Project advisories (GitHub)

Description

Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation of Permissions resulting in privilege escalation on some folders where Admin is the only used permission. The vulnerability impacts Grafana instances where RBAC was disabled and enabled afterwards, as the migrations which are translating…

Affected software

SoftwareAffected versions
GrafanaServers and applications · cpe:a:grafana:grafana
  • Every version before 8.5.13
  • From 9.0.0 before 9.0.9
  • From 9.1.0 before 9.1.6
GrafanaServers and applications · github:grafana/grafana
  • From 8.5.0 before 8.5.13

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-36062
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-36062
  • GitHub Advisory Database https://github.com/advisories/GHSA-p978-56hq-r492
  • github.com https://github.com/grafana/grafana/security/advisories/GHSA-p978-56hq-r492