{"answers":{"affected":"3 open source packages ship an affected version, including github.com/grafana/grafana and grafana. It affects 1 product.","exploited":"There is no known exploitation of CVE-2023-4822 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2023-4822 is a medium-severity vulnerability in Grafana Grafana, published on 16 Oct 2023. An attacker needs administrator access to exploit it, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-4822 and fix it if it is affected.\n\nWhat it is: CVE-2023-4822 is a medium-severity vulnerability in Grafana Grafana, published on 16 Oct 2023. An attacker needs administrator access to exploit it, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-4822 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/grafana/grafana (Go): affected all versions up to 10.1.5; no fix listed\n- github.com/grafana/grafana (Go): affected all versions up to 10.1.5; no fix listed\n- grafana (Bitnami): affected from 8.0.0 up to 10.1.4; fixed in 9.4.16, 9.5.11, 10.0.7, 10.1.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-4822/ (Markdown: https://insights.sbomify.com/CVE-2023-4822/index.md)","id":"CVE-2023-4822","markdown":"https://insights.sbomify.com/CVE-2023-4822/index.md","name":"CVE-2023-4822","record":{"aliases":["BIT-grafana-2023-4822","GHSA-fw9c-75hh-89p6","UBUNTU-CVE-2023-4822"],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["privilege_escalation","data_modify"],"network_reachable":"yes","non_default_config":true,"product_category":"Grafana monitoring platform","requires_auth":"high_privilege","summary":"An Organization Admin can escalate privileges or modify permissions globally across all organizations, requiring multi-org setup.","user_interaction":"not_required","vuln_class":"privilege_escalation"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GRAFANA","cpe":[{"product":"grafana","vendor":"grafana"}],"cvss":{"score":6.7,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"cwes":[{"id":"CWE-269","name":"Improper Privilege Management"}],"description":"Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations.\n\nIt also allows an Organization Admin to assign or revoke any permissions that they have to any user globally.\n\nThis means that any Organization Admin can elevate their own permissions in any organization that they are already a member of, or elevate or restrict the permissions of any other user.\n\nThe vulnerability does not allow a user to become a member of an organization that they are not already a member of, or to add any other users to an organization that the current user is not a member of.","ecosystems":["Bitnami","Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Grafana privilege escalation vulnerability","id":"CVE-2023-4822","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":"grafana:grafana","products":["grafana:grafana"],"type":"privilege_escalation","year":"2023"},"n_packages":3,"n_references":2,"next":{"headline":"WP Meta and Date Remover \u003c 2.2.0 - Subscriber+ Stored XSS","id":"CVE-2023-4823"},"packages":[{"ecosystem":"Bitnami","fixed":["9.4.16","9.5.11","10.0.7","10.1.3"],"introduced":["8.0.0","9.5.0","10.0.0","10.1.0","10.1.4"],"last_affected":["10.1.4"],"package":"grafana","purl":"pkg:bitnami/grafana","source":"BIT-grafana-2023-4822"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["10.1.5"],"package":"github.com/grafana/grafana","purl":null,"source":"GHSA-fw9c-75hh-89p6"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["10.1.5"],"package":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","source":"GHSA-fw9c-75hh-89p6"}],"prev":{"headline":"Drag and Drop Multiple File Upload \u003c 1.1.1 - Unauthenticated Stored Cross-Site Scripting","id":"CVE-2023-4821"},"products":["Grafana Enterprise"],"published":"2023-10-16","related":[{"cvss_score":7.5,"headline":"Grafana Path Traversal","id":"CVE-2021-43798","kev_date_added":"2025-10-09","published":"2021-12-07"},{"cvss_score":10,"headline":"Incorrect privilege assignment","id":"CVE-2025-41115","kev_date_added":null,"published":"2025-11-21"},{"cvss_score":9.8,"headline":"Grafana vulnerable to race condition allowing privilege escalation","id":"CVE-2022-39328","kev_date_added":null,"published":"2022-11-08"},{"cvss_score":9.8,"headline":"Auth bypass in n/a","id":"CVE-2022-28660","kev_date_added":null,"published":"2022-05-20"},{"cvss_score":9.8,"headline":"Information disclosure in n/a","id":"CVE-2022-26148","kev_date_added":null,"published":"2022-03-21"},{"cvss_score":9.8,"headline":"Grafana Authentication Bypass","id":"CVE-2018-15727","kev_date_added":null,"published":"2018-08-29"},{"cvss_score":9.4,"headline":"Grafana SQL Expressions allow for remote code execution","id":"CVE-2024-9264","kev_date_added":null,"published":"2024-10-18"}],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-01-30","vendors":["Grafana"]},"summary":"An Organization Admin can escalate privileges or modify permissions globally across all organizations, requiring multi-org setup.","url":"https://insights.sbomify.com/CVE-2023-4822/"}