CVE-2024-1313
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedIt is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/<key> using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized. Grafana Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and disclosing this vulnerability. This issue affects Grafana: from 9.5.0 before 9.5.18, from 10.0.0 before 10.0.13, from 10.1.0 before 10.1.9, from 10.2.0 before 10.2.6, from 10.3.0 before 10.3.5.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceGrafana snapshots have an authorization bypass where users from different organizations than the snapshot owner can delete snapshots by issuing a DELETE request to /api/snapshots/<key> using a view key. The authorization logic incorrectly treats deletion requests from unprivileged users in different organizations as authorized, when only users with write/edit permissions should be able to delete.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify Grafana versionRun `grafana-server --version` or check the version via the UI at /api/health or the admin settings pageAffected if The installed version is 9.5.x before 9.5.18, 10.0.x before 10.0.13, 10.1.x before 10.1.9, 10.2.x before 10.2.6, or 10.3.x before 10.3.5
-
Confirm snapshots feature is in useQuery your Grafana database or API: GET /api/snapshots to list existing snapshots, or check if any dashboards have associated snapshotsAffected if Any snapshots exist in the system, indicating the vulnerable feature is active
-
Review API access logs for snapshot DELETE requestsSearch web server and Grafana logs for DELETE requests to /api/snapshots/ endpoints, noting the requesting user/org and the snapshot owner orgAffected if DELETE requests to /api/snapshots/<key> were made by users from organizations different from the snapshot owner
-
Inspect snapshot sharing permissionsCheck the snapshot configuration via GET /api/snapshots/<key> or database snapshot table for external deletion key usage and owner organization IDAffected if Snapshots are configured with view keys accessible across organizations, or deletion requests used view keys from non-owner orgs
You are affected if your Grafana version is within the vulnerable 9.5.x, 10.0.x, 10.1.x, 10.2.x, or 10.3.x ranges and snapshots exist with cross-organization access or unauthorized DELETE activity is present in logs.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scopedUpgrade Grafana to version 9.5.18, 10.0.13, 10.1.9, 10.2.6, or 10.3.5 or later. Until patched, monitor API access logs for unauthorized DELETE requests to /api/snapshots/* endpoints and restrict snapshot view key distribution.
Upgrade to Grafana 9.5.18+ / 10.0.13+ / 10.1.9+ / 10.2.6+ / 10.3.5+ (choose the branch matching your current version)
- 1. Identify the current Grafana version by checking the Grafana UI (Settings > About) or running 'grafana-server -v'
- 2. Based on the current version, determine the appropriate upgrade path to a fixed release: For 9.5.x → upgrade to 9.5.18 or later; For 10.0.x → upgrade to 10.0.13 or later; For 10.1.x → upgrade to 10.1.9 or later; For 10.2.x → upgrade to 10.2.6 or later; For 10.3.x → upgrade to 10.3.5 or later
- 3. Review Grafana upgrade documentation for your deployment method (docker, apt, yum, or binary)
- 4. Create a backup of Grafana configuration and data directories before upgrading
- 5. Perform the upgrade using your package manager or by downloading the appropriate package from grafana.com
- 6. Verify the upgrade was successful and Grafana starts without errors
- 7. Test that snapshots can only be deleted by users with proper authorization within the same organization
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation4.0 h
- Implementation8.0 h
- Testing6.0 h
- Review / QA4.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,176.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2024-1313 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2024-1313 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data