CVEvulnerability

CVE-2026-14199

8.1 HIGH Published 2026-09-02 Modified 2026-09-15 Official page ↗
Status
Analyzed
Published
2026-09-02
Last modified
2026-09-15
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-1023, CWE-290, CWE-863

Description

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is live, is authenticated as that user, up to Administrator (authentication bypass by spoofing).

Affected configurations

• grafana grafana (< 11.0.0) • grafana grafana (>= 12.4.10 < 13.0.0) • grafana grafana (>= 13.0.8 < 13.1.0) • grafana grafana (>= 13.1.5 < 13.2.0)

Related

Weakness · CWE (3)

  • CWE-1023 Incomplete Comparison with Missing Factors weakness
  • CWE-290 Authentication Bypass by Spoofing weakness
  • CWE-863 Incorrect Authorization weakness

References