CVE-2024-9476

A privilege escalation vulnerability has been discovered in Self-managed Grafana OSS and Grafana Enterprise, affecting the Grafana Cloud Migration Assistant. The flaw allows users to gain unauthorized access to resources (dashboards, folders, data sources) from other organizations within the same Grafana instance, bypassing intended resource isolation. This issue impacts customers using the Organizations feature for multi-organization setups.

This vulnerability doesn't affect any version of Grafana as shipped with any supported Red Hat product. The affected upstream version is 11.2 while Red Hat doesn't ship such version.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.