CVE-2023-4822

What it actually does

Authorization bypass allowing an Organization Admin in one organization to modify role permissions (Viewer, Editor, Admin) across all organizations and globally assign or revoke any permissions they hold to any user.

Why it matters to the business

Admins in one team can silently gain or remove access to monitoring data and configurations belonging to other teams or the entire instance, increasing risk of data exposure or unauthorized changes in shared observability platforms.

How an attack unfolds

An attacker who already holds Organization Admin in at least one organization identifies other organizations or users they can reach, then uses the vulnerable permission-modification interfaces to elevate their own roles or alter permissions for others without needing membership in additional organizations.

How to fix it

Upgrade Grafana to the first patched release that addresses CVE-2023-4822. Until then restrict Organization Admin grants to trusted users only and enable detailed audit logging for permission changes.

How to confirm the fix worked

Confirm Grafana version is newer than the vulnerable releases, review audit logs for cross-organization permission modifications, and test that Organization Admins can no longer alter roles outside their own organization.

Typical attack path

1. Obtain Organization Admin role in a single organization
2. Enumerate other organizations and users via existing API access
3. Issue requests that modify role permissions or user grants across organizations
4. Elevate self or restrict others to achieve desired access

How to detect it

Search Grafana audit logs and HTTP access logs for permission-update API calls originating from Organization Admin accounts that affect organizations other than the caller's own; look for repeated role or user permission changes outside normal administrative activity.

• /api/admin/users/*/permissions
• /api/orgs/*/users/*/permissions
• permission update events referencing multiple orgIds
• grafana-server audit entries showing role changes by non-server-admin users

What your security team should do

• Immediately audit all Organization Admin assignments and reduce their number
• Enable and retain Grafana audit logs for permission changes
• Upgrade to the fixed Grafana version as soon as it is released
• Monitor EPSS and KEV status for any future increase in exploit activity