{"cve":"CVE-2024-6322","nvd":{"published":"2024-08-20T18:15:09.900","modified":"2026-06-17T08:17:46.607","status":"Deferred","description":"Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L","score":5.4},"cwes":["CWE-266"],"references":["https://grafana.com/security/security-advisories/cve-2024-6322/"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:54:16.205165117+00:00"},"epss":{"cve":"CVE-2024-6322","score":0.00305,"percentile":0.23341,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-hh8p-374f-qgr5","url":"https://osv.dev/vulnerability/GHSA-hh8p-374f-qgr5","summary":"Grafana plugin data sources vulnerable to access control bypass","modified":"2026-09-10T03:50:18.159775297Z","packages":[{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":[">=11.1.0 <11.1.1"],"fixed":["11.1.1"]},{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":[">=11.1.2 <11.1.3"],"fixed":["11.1.3"]},{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":[">=0.0.0-20240521130516-0072e4a92d89 <0.0.0-20240725142242-c326d865c58b"],"fixed":["0.0.0-20240725142242-c326d865c58b"]},{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":[">=1.9.2-0.20240521130516-0072e4a92d89 <1.9.2-0.20240725142242-c326d865c58b"],"fixed":["1.9.2-0.20240725142242-c326d865c58b"]}]},{"id":"GO-2024-3079","url":"https://osv.dev/vulnerability/GO-2024-3079","summary":"Grafana plugin data sources vulnerable to access control bypass in github.com/grafana/grafana","modified":"2026-02-04T04:33:32.558145Z","packages":[{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}