UpHeron
All vulnerabilities

Servers and applications

CVE-2022-39306

Email addresses and usernames can not be trusted

Severity
High 8.1
Published
8 Nov 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
8.x, 8.5.15, 9.2.4
Also known as
GHSA-2x6g-h2hg-rq84
Sources
NVD, Project advisories (GitHub)

Description

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins add members to the organization, non existing users get an email invite, existing members are added directly to the organization. When an…

Affected software

SoftwareAffected versions
GrafanaServers and applications · cpe:a:grafana:grafana
  • From 8.0.0 before 8.5.15
  • From 9.0.0 before 9.2.4
GrafanaServers and applications · github:grafana/grafana
  • Every version before 8.x

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-39306
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-39306
  • GitHub Advisory Database https://github.com/advisories/GHSA-2x6g-h2hg-rq84
  • github.com https://github.com/grafana/grafana/security/advisories/GHSA-2x6g-h2hg-rq84