CVE-2024-1313

What it actually does

Authorization logic flaw permits cross-organization DELETE requests to /api/snapshots/<key> using only the view key, bypassing intended write/edit permission checks.

Why it matters to the business

Attackers can remove historical snapshots, causing loss of visibility into past system states and potential disruption of monitoring or compliance records.

How an attack unfolds

An attacker in a separate organization obtains a target snapshot's view key, then issues a DELETE request to the snapshot endpoint; the flawed authorization treats the request as valid and deletes the snapshot.

How to fix it

Upgrade Grafana to 9.5.18, 10.0.13, 10.1.9, 10.2.6, or 10.3.5 (or later) depending on the installed branch; restrict snapshot visibility where possible until patched.

How to confirm the fix worked

Verify running version against the fixed releases; attempt cross-org snapshot deletion with a test account and confirm the request is now rejected.

Typical attack path

1. Acquire snapshot view key from a different organization
2. Craft and send unauthenticated DELETE request to /api/snapshots/<key>
3. Bypass triggers deletion without write permission enforcement

How to detect it

Search web server and Grafana access logs for DELETE requests to /api/snapshots/ paths originating from accounts outside the snapshot owner's organization; review audit trails for unexpected snapshot removals.

• DELETE /api/snapshots/
• snapshot deletion without edit permission

What your security team should do

• Apply the listed version upgrades immediately
• Audit Grafana access logs for prior unauthorized snapshot deletions
• Limit snapshot sharing to the minimum necessary organizations