CVE-2021-28146

Name of the Vulnerable Software and Affected Versions: Grafana Enterprise versions 7.4.0 through 7.4.4

Description: The team sync HTTP API in Grafana Enterprise has an Incorrect Access Control issue. On Grafana instances using an external authentication service, this issue allows any authenticated user to add external groups to existing teams, potentially granting a user team permissions that the user isn't supposed to have.

Recommendations: For versions 7.4.0 through 7.4.4, update to version 7.4.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the team sync HTTP API to minimize the risk of exploitation.