CLEANSTART-2026-DS64182 team sync HTTP API in Grafana Enterprise 6

Security vulnerability affects the grafana package. The team sync HTTP API in Grafana Enterprise 6...

CLEANSTART-2026-NN87999 team sync HTTP API in Grafana Enterprise 7

Security vulnerability affects the grafana package. The team sync HTTP API in Grafana Enterprise 7...

Authorization Bypass

grafana is vulnerable to authorization bypass. The team sync HTTP API allows any authenticated user to add external groups to existing teams. This vulnearbilitycan be abused to grant a user team arbitrary permissions...

ALPINE-CVE-2021-28147

The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated...

ALPINE-CVE-2021-28146

The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service, this vulnerability allows any authenticated user to add external groups to existing teams. This can be used to grant a user team...

CVE-2021-28147

The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated...

CVE-2021-28146

The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service, this vulnerability allows any authenticated user to add external groups to existing teams. This can be used to grant a user team...

CVE-2021-28147: Undefined Security Weakness

The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated...

PT-2021-17772

Name of the Vulnerable Software and Affected Versions: Grafana Enterprise versions 7.4.0 through 7.4.4 Description: The team sync HTTP API in Grafana Enterprise has an Incorrect Access Control issue. On Grafana instances using an external authentication service, this issue allows any authenticate...

CVE-2021-28146: Incorrect Authorization

The team sync HTTP API in Grafana Enterprise 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service, this vulnerability allows any authenticated user to add external groups to existing teams. This can be used to grant a user team...