-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/grafana/grafana | go | >= 8.5.0, < 8.5.13 | 8.5.13 |
| github.com/grafana/grafana | go | >= 9.0.0, < 9.0.9 | 9.0.9 |
| github.com/grafana/grafana | go | >= 9.1.0, < 9.1.6 | 9.1.6 |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from flawed RBAC migration logic that improperly translated legacy permissions. The advisory specifically mentions that 'migrations contain a bug which grants additional access' when only Admin permissions existed. While exact function names aren't disclosed, Grafana's architecture places RBAC migrations in the sqlstore service, and the CWE-281 (Improper Preservation of Permissions) directly points to permission translation logic as the vulnerable component. The high confidence comes from the direct correlation between described vulnerability behavior and standard Grafana RBAC migration implementation patterns.
All Grafana installations where the RBAC was at least enabled once and there are folders/dashboards with only Admin grant.
To fully address CVE-2022-36062 please upgrade your Grafana instances. They are only required if you have ever enabled RBAC and have dashboards/folders where Admin is the only permission..
If you can’t upgrade, as a workaround when impacted folder/dashboard is known, the additional permissions can be removed manually.
Appropriate patches have been applied to Grafana Cloud.
Here is a timeline starting from when we originally learned of the issue.
If you think you have found a security vulnerability, please send a report to security@grafana.com. This address can be used for all of Grafana Labs' open source and commercial products (including, but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com). We can accept only vulnerability reports at this address. We would prefer that you encrypt your message to us by using our PGP key. The key fingerprint is
F988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CA
The key is available from keyserver.ubuntu.com.
We maintain a security category on our blog, where we will always post a summary, remediation, and mitigation details for any patch containing security fixes.
You can also subscribe to our RSS feed.
KEV Misses 88% of Exploited CVEs- Get the report