UpHeron
All vulnerabilities

Servers and applications

CVE-2022-39229

Using email as a username can block other users from signing in

Severity
Medium 4.3
Published
12 Oct 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
8.5.14, 9.1.8
Also known as
GHSA-gj7m-853r-289r
Sources
NVD, Project advisories (GitHub)

Description

Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. A user can have…

Affected software

SoftwareAffected versions
GrafanaServers and applications · cpe:a:grafana:grafana
  • Every version before 8.5.14
  • From 9.0.0 before 9.1.8
GrafanaServers and applications · github:grafana/grafana
  • Every version before 8.5.14

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-39229
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-39229
  • GitHub Advisory Database https://github.com/advisories/GHSA-gj7m-853r-289r
  • github.com https://github.com/grafana/grafana/security/advisories/GHSA-gj7m-853r-289r