7.5

CVE-2022-31107: grafana Incorrect Authorization

CVSS: 7.5v3.1HighModified
AliasesRHSA-2022:5716RHSA-2022:5717RHSA-2022:5718
Published 15-07-2022Last modified 28-01-2026
Open JSON

Vulnerability summary

CVE-2022-31107 is a high (CVSS 7.5) Incorrect Authorization vulnerability in grafana. EPSS estimates a 2.87% chance of exploitation in the next 30 days, higher than 86.6% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
2.87%
0%100%
Low · +0.16 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 13 · Related 15
OPENSUSE-SU-2024:12260-1SUSE-SU-2022:3676-1SUSE-SU-2022:3747-1SUSE-SU-2022:3751-1SUSE-SU-2022:3765-1SUSE-SU-2022:4428-1

Timeline

  1. 15-07-2022
    PublishedVulnerability first disclosed.
  2. 28-01-2026
    Last modifiedVulnerability information updated.

Description

Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana. Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user's Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.

CVSS metrics

7 scores · 6 sources · 2 versions

EPSS trend

Probability

2.87%

Chance of exploitation in the next 30 days

Percentile

87%

Versus all other CVEs

30-day change

+0.16 pp

From 2.72% on 18-09-2026

18-09-202618-10-2026
EPSS score
2.87%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat14 products
  • grafana< 0:7.5.11-5.el9_0 | < 0:7.5.11-3.el8_6 | < 0:7.3.6-5.el8_4 | < 0:6.3.6-5.el8_2 | < 0:6.2.2-9.el8_1
  • grafana-azure-monitor< 0:6.3.6-5.el8_2 | < 0:6.2.2-9.el8_1
  • grafana-cloudwatch< 0:6.3.6-5.el8_2 | < 0:6.2.2-9.el8_1
  • grafana-debuginfo< 0:7.5.11-5.el9_0 | < 0:7.5.11-3.el8_6 | < 0:7.3.6-5.el8_4 | < 0:6.3.6-5.el8_2 | < 0:6.2.2-9.el8_1
  • grafana-elasticsearch< 0:6.3.6-5.el8_2 | < 0:6.2.2-9.el8_1
Chainguard8 products
  • grafana-fips-11.6All versions (No fix recorded)
  • grafana-fips-12.0< 12.0.10-r6
  • grafana-fips-12.1< 12.1.10.01-r3
  • grafana-fips-12.2All versions (No fix recorded)
  • grafana-fips-12.3All versions (No fix recorded)
Github.com/grafana1 product
  • grafana≥ 5.3.0-beta1, < 8.3.10 | ≥ 8.4.0, < 8.4.10 | ≥ 8.5.0, < 8.5.9 | ≥ 9.0.0, < 9.0.3 | All versions (No fix recorded)
Grafana1 product
  • grafana≥ 5.3, < 8.3.10 | ≥ 5.3.0, < 8.3.10 | ≥ 8.4.0, < 8.4.10 | ≥ 8.5.0, < 8.5.9 | ≥ 9.0.0, < 9.0.3
Netapp1 product
Ubuntu1 product
  • grafanaAll versions (No fix recorded)

6 vendors · 26 products

References

27 links
Show all 27 references