-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper UID validation in data source creation flow. While exact code diffs aren't available, the pattern matches API handlers and service layer functions responsible for processing UID parameters. The first function likely accepts the wildcard UID from API requests, while the second persists it without verifying if the user should have organization-wide access. Together they enable privilege escalation through UID='*' assignment, consistent with CWE-269's improper privilege management description.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/grafana/grafana | go | >= 8.5.0, < 9.5.7 | 9.5.7 |
| github.com/grafana/grafana | go | >= 10.0.0, < 10.0.12 | 10.0.12 |
| github.com/grafana/grafana | go | >= 10.1.0, < 10.1.8 | 10.1.8 |
| github.com/grafana/grafana | go | >= 10.2.0, < 10.2.5 | 10.2.5 |
| github.com/grafana/grafana | go | >= 10.3.0, < 10.3.4 | 10.3.4 |