CVE-2022-21713: Exposure of Sensitive Information in Grafana
Vulnerability summary
CVE-2022-21713 is a medium (CVSS 4.3) Incorrect Authorization vulnerability in fedoraproject fedora. EPSS estimates a 1.18% chance of exploitation in the next 30 days, higher than 67.6% of scored vulnerabilities.
Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 9 · Related 7Timeline
- 08-02-2022PublishedVulnerability first disclosed.
- 23-04-2025Last modifiedVulnerability information updated.
Description
Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view unintended data by querying for the specific team ID, `/teams/:search` will allow an authenticated attacker to search for teams and see the total number of available teams, including for those teams that the user does not have access to, and `/teams/:teamId/members` when editors_can_admin flag is enabled, an authenticated attacker can see unintended data by querying for the specific team ID. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · GoEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · AlpineEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
1.18%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.18% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
- CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Alpine1 product
- grafana≥ 5.0.0, < 8.3.6-r0
Fedoraproject1 product
- fedoraEOL34 | 35 | 36
Github.com/grafana1 product
- grafana≥ 5.0.0-beta1, < 7.5.15 | ≥ 8.0.0, < 8.3.5
Grafana1 product
- grafana≥ 5.0.0-beta1, < 7.5.15 | ≥ 5.0.0, < 7.5.15 | ≥ 8.0.0, < 8.3.5 | 5.0.0:beta1 | 5.0.0:beta2 | 5.0.0:beta3 | 5.0.0:beta4 | 5.0.0:beta5
Netapp1 product
Ubuntu1 product
- grafanaAll versions (No fix recorded)
6 vendors · 6 products
References
17 links- grafana.com/blog/2022/02/08/grafana-7.5.15-and-8.3.5-released-with-moderate-severity-security-fixes/X Refsource MISCRelease NotesVendor Advisory
- github.com/grafana/grafana/security/advisories/GHSA-63g3-9jq3-mccvX Refsource CONFIRMWEBRelease NotesThird Party Advisory
Show all 17 references
- github.com/grafana/grafanaPACKAGE