CVE-2023-4822

Name of the Vulnerable Software and Affected Versions Grafana (affected versions not specified)

Description The issue impacts Grafana instances with multiple organizations, allowing a user with Organization Admin permissions in one organization to change permissions associated with Organization Viewer, Organization Editor, and Organization Admin roles in all organizations. This enables an Organization Admin to assign or revoke any permissions they have to any user globally, potentially elevating their own permissions or those of other users within organizations they are already a member of. The issue does not permit a user to join an organization they are not a member of or add users to an organization they are not part of.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.