-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from an API endpoint that handles test alert requests (/api/alertmanager/grafana/config/api/v1/receivers/test) which did not implement proper role-based access controls. While the UI hides this functionality from Viewers, the API handler itself failed to verify user permissions. The PoC demonstrates Viewer role users can successfully POST to this endpoint. The combination of missing authorization checks in the API handler (CWE-862) and improper access control (CWE-284) directly matches the vulnerability description. The file path is inferred from standard Grafana project structure where alert management API handlers are typically located.
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/grafana/grafana | go | < 8.5.26 | 8.5.26 |
| github.com/grafana/grafana | go | >= 9.0.0, < 9.2.19 | 9.2.19 |
| github.com/grafana/grafana |
| go |
| >= 9.3.0, < 9.3.15 |
| 9.3.15 |
| github.com/grafana/grafana | go | >= 9.4.0, < 9.4.12 | 9.4.12 |
| github.com/grafana/grafana | go | >= 9.5.0, < 9.5.3 | 9.5.3 |
Ongoing coverage of React2Shell