Medium severity · published Nov 13, 2024
CVE-2024-9476
Privilege escalation vulnerability for Organizations in Grafana
5.1
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizations feature to isolate resources on their Grafana instance.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Grafana · Grafana
11.3.0 before 11.3.0+security-01; 11.2.0 before 11.2.3+security-01 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9476
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9476
grafana.com
https://grafana.com/blog/2024/11/12/grafana-security-release-medium-severity-security-fix-for-cve-2024-9476/
grafana.com
https://grafana.com/security/security-advisories/cve-2024-9476/
More from Grafana
7.5
CVE-2021-43798
Grafana path traversal
7.3
CVE-2021-39226
Snapshot authentication bypass in grafana
9.9
CVE-2025-11539
Arbitrary Code Execution in Grafana Image Renderer Plugin
9.8
CVE-2025-41115
Incorrect privilege assignment
9.8
CVE-2023-3128
Grafana is validating Azure AD accounts based on the email claim