{"answers":{"affected":"3 open source packages ship an affected version, including github.com/grafana/grafana and grafana. It affects 1 product.","exploited":"There is no known exploitation of CVE-2021-41244 in the wild and no public exploit code.","fix":"Upgrade github.com/grafana/grafana to 8.2.4 or later.","what":"CVE-2021-41244 is a critical missing authorization vulnerability in Grafana Grafana, published on 15 Nov 2021. An attacker needs administrator access to exploit it, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2021-41244 and fix it if it is affected.\n\nWhat it is: CVE-2021-41244 is a critical missing authorization vulnerability in Grafana Grafana, published on 15 Nov 2021. An attacker needs administrator access to exploit it, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2021-41244 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/grafana/grafana (Go): affected from 8.0.0; fixed in 8.2.4\n- github.com/grafana/grafana (Go): affected from 8.0.0; fixed in 8.2.4\n- grafana (Bitnami): affected from 8.0.0; fixed in 8.2.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2021-41244/ (Markdown: https://insights.sbomify.com/CVE-2021-41244/index.md)","id":"CVE-2021-41244","markdown":"https://insights.sbomify.com/CVE-2021-41244/index.md","name":"CVE-2021-41244","record":{"aliases":["BIT-grafana-2021-41244","CVE-2021-43320","GHSA-mpwp-42x6-4wmx","UBUNTU-CVE-2021-41244"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["privilege_escalation","data_modify"],"network_reachable":"yes","non_default_config":true,"product_category":"Grafana monitoring platform","requires_auth":"high_privilege","summary":"Organization admins can modify users in other organizations when fine-grained access control is enabled, requiring an upgrade or feature disablement.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"grafana","vendor":"grafana"}],"cvss":{"score":9.1,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"},{"id":"CWE-610","name":"Externally Controlled Reference to a Resource in Another Sphere"}],"description":"Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance admins are able to access users from other organizations. Grafana 8.0 introduced a mechanism which allowed users with the Organization Admin role to list, add, remove, and update users’ roles in other organizations in which they are not an admin. With fine-grained access control enabled, organization admins can list, add, remove and update users' roles in another organization, where they do not have organization admin role. All installations between v8.0 and v8.2.3 that have fine-grained access control beta enabled and more than one organization should be upgraded as soon as possible. If you cannot upgrade, you should turn off the fine-grained access control using a feature flag.","ecosystems":["Bitnami","Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Cross organization admin control in Grafana","id":"CVE-2021-41244","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":"grafana:grafana","products":["grafana:grafana"],"type":"missing_authorization","year":"2021"},"n_packages":3,"n_references":4,"next":{"headline":"Possible Cross-Site Request Forgery in Combodo iTop","id":"CVE-2021-41245"},"packages":[{"ecosystem":"Bitnami","fixed":["8.2.4"],"introduced":["8.0.0"],"last_affected":[],"package":"grafana","purl":"pkg:bitnami/grafana","source":"BIT-grafana-2021-41244"},{"ecosystem":"Go","fixed":["8.2.4"],"introduced":["8.0.0"],"last_affected":[],"package":"github.com/grafana/grafana","purl":null,"source":"GHSA-mpwp-42x6-4wmx"},{"ecosystem":"Go","fixed":["8.2.4"],"introduced":["8.0.0"],"last_affected":[],"package":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","source":"GHSA-mpwp-42x6-4wmx"}],"prev":{"headline":"OS Command Injection Vulnerability and Potential Zip Slip Vulnerability","id":"CVE-2021-41243"},"products":["grafana"],"published":"2021-11-15","related":[{"cvss_score":7.5,"headline":"Grafana Path Traversal","id":"CVE-2021-43798","kev_date_added":"2025-10-09","published":"2021-12-07"},{"cvss_score":10,"headline":"Incorrect privilege assignment","id":"CVE-2025-41115","kev_date_added":null,"published":"2025-11-21"},{"cvss_score":9.8,"headline":"Grafana vulnerable to race condition allowing privilege escalation","id":"CVE-2022-39328","kev_date_added":null,"published":"2022-11-08"},{"cvss_score":9.8,"headline":"Auth bypass in n/a","id":"CVE-2022-28660","kev_date_added":null,"published":"2022-05-20"},{"cvss_score":9.8,"headline":"Information disclosure in n/a","id":"CVE-2022-26148","kev_date_added":null,"published":"2022-03-21"},{"cvss_score":9.8,"headline":"Grafana Authentication Bypass","id":"CVE-2018-15727","kev_date_added":null,"published":"2018-08-29"},{"cvss_score":9.4,"headline":"Grafana SQL Expressions allow for remote code execution","id":"CVE-2024-9264","kev_date_added":null,"published":"2024-10-18"}],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-04","vendors":["grafana"]},"summary":"Organization admins can modify users in other organizations when fine-grained access control is enabled, requiring an upgrade or feature disablement.","url":"https://insights.sbomify.com/CVE-2021-41244/"}