Critical · published November 15, 2021
🚨 Grafana's fine-grained access control is giving too much power to the wrong hands! 😱 This vulnerability is like a hotel manager who can access guest records in other hotels just because they work at the same chain — a serious breach of privacy! 🏨 Imagine an organization admin being able to peek into other organizations' user roles and settings, which could lead to unauthorized changes, data exposure, or even sabotage. This could be absolutely devastating for trust and security among users! 🔥
This vulnerability is like a hotel manager who can access guest records in other hotels just because they work at the same chain — a serious breach of privacy! 🏨 In versions 8.0 to 8.2.3 of Grafana, with fine-grained access control enabled, organization admins can manipulate users in other organizations incorrectly, bypassing intended restrictions.
Imagine an organization admin being able to peek into other organizations' user roles and settings, which could lead to unauthorized changes, data exposure, or even sabotage. This could be absolutely devastating for trust and security among users! 🔥 To protect your Grafana instance, upgrade to version 8.2.4 or later immediately. If upgrading isn't feasible, disable the fine-grained access control feature using a configuration flag until you can patch. 🛡️ You've got this! By taking action, you're stepping up as a security hero! 💪✨