CVE-2024-10452 Grafana org admin can delete pending invites in different org

What is CVE-2024-10452?

CVE-2024-10452 is a low-severity missing authorization vulnerability in Grafana Grafana, published on 29 Oct 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Organization admins can delete pending invites created in an organization they are not part of.

Weakness: CWE-639

Which versions are affected by CVE-2024-10452?

4 open source packages ship an affected version, including github.com/grafana/grafana and grafana. It affects 1 product.

Products include Grafana Grafana.

How do I fix CVE-2024-10452?

Apply the vendor's patch.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-10452 being exploited?

There is no known exploitation of CVE-2024-10452 in the wild and no public exploit code.

Other vulnerabilities in Grafana Grafana

• CVE-2021-43798 Grafana Path Traversal Exploited High 7.5
• CVE-2025-41115 Incorrect privilege assignment Critical 10.0
• CVE-2022-39328 Grafana vulnerable to race condition allowing privilege escalation Critical 9.8
• CVE-2022-28660 Auth bypass in n/a Critical 9.8
• CVE-2022-26148 Information disclosure in n/a Critical 9.8

All Grafana Grafana vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-grafana-2024-10452, CLSA-2026-1789290656, GHSA-66c4-2g2v-54qw, GO-2024-3240, MINI-2j5x-253p-6fv5, MINI-4mmg-j324-j89g and 12 more.