CVE-2024-1313

FAUCET Score

CVE-2024-1313 is an authorization bypass vulnerability in Grafana versions 9.5.0 through 9.5.17, 10.0.0 through 10.0.12, 10.1.0 through 10.1.8, 10.2.0 through 10.2.5, and 10.3.0 through 10.3.4. An authenticated user in a different organization than a snapshot owner can delete the snapshot by sending a DELETE request with its view key. This medium-severity vulnerability (CVSS 6.5) allows for unauthorized data integrity impact (I:H) with low attack complexity and no user interaction required. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 10.0.0, < 10.0.13CPE match	cpe:2.3:a:grafana:grafana::::::::
		>= 10.1.0, < 10.1.9CPE match	cpe:2.3:a:grafana:grafana::::::::
		>= 10.2.0, < 10.2.6CPE match	cpe:2.3:a:grafana:grafana::::::::
		>= 10.3.0, < 10.3.5CPE match	cpe:2.3:a:grafana:grafana::::::::
		>= 9.5.0, < 9.5.18CPE match	cpe:2.3:a:grafana:grafana::::::::

CVSS Data

CVSS version used by this source: 3.1

6.5MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

Exploitability Score

2.8

Impact Score

3.6

CvssVersion

3.1

Exploit Intelligence

EPSS Score

0.65%

Probability of exploitation in next 30 days

EPSS Percentile

47.3%

Percentile rank of EPSS score among Peer Group

As of 2026-07-28

Model: v2026.06.15

This CVE's current EPSS score of 0.0065 is in the 57th percentile among its peer group of 21,977 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (16)

gopatch availablevia ghsa

Product: github.com/grafana/grafanaFixed in: 9.5.18

gopatch availablevia ghsa

Product: github.com/grafana/grafanaFixed in: 10.0.13

gopatch availablevia ghsa

Product: github.com/grafana/grafanaFixed in: 10.1.9

gopatch availablevia ghsa

Product: github.com/grafana/grafanaFixed in: 10.2.6

gopatch availablevia ghsa

Product: github.com/grafana/grafanaFixed in: 10.3.5

nodejspatch availablevia llm_extracted

View patch

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: grafana-0:9.2.10-16.el9_4

View patch

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: grafana-0:9.2.10-16.el8_10

View patch

apollographqlvendor investigatingvia llm_extracted

View patch

chainsafevendor investigatingvia llm_extracted

View patch

jenkinsvendor investigatingvia llm_extracted

View patch

kenticovendor investigatingvia llm_extracted

View patch

zimbravendor investigatingvia llm_extracted

View patch

redhatno patchvia redhat_api

Product: Red Hat Ceph Storage 5Fixed in: rhceph/rhceph-5-dashboard-rhel8

redhatno patchvia redhat_api

Product: Red Hat Ceph Storage 7Fixed in: rhceph/grafana-rhel9

redhatend of lifevia redhat_api

Product: Red Hat Ceph Storage 6Fixed in: rhceph/rhceph-6-dashboard-rhel9

Vendor Advisories (8)

goGHSA-67rv-qpw2-6qrrhigh

Grafana: Users outside an organization can delete a snapshot with its key

Apr 5, 2024

redhatCVE-2024-1313Moderate

grafana: vulnerable to authorization bypass

Mar 26, 2024

zimbrallm-zimbra-579f406b26d71109MEDIUM