CVE-2026-22640

216.73.217.50

· Published 15/01/2026 14:16 · Modified 16/01/2026 15:55

Labels: CVE-2026-22640 2026-01-15 CVE-2026-22640 CWE-284 [email protected]

Essential information

Published: 15/01/2026 14:16
Modified: 16/01/2026 15:55
Author: —
Creator: —
CVSS: 5.5 MEDIUM (v3.1)
CISA KEV: No
CWE: —
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

CVSS metrics

Description

An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. This vulnerability exists in the DELETE /api/org/users/ endpoint. The vulnerability can be exploited when: 1. An Organization administrator exists 2. The Server administrator is either: - Not part of any organization, or - Part of the same organization as the Organization administrator Impact: - Organization administrators can permanently delete Server administrator accounts - If the only Server administrator is deleted, the Grafana instance becomes unmanageable - No super-user permissions remain in the system - Affects all users, organizations, and teams managed in the instance The vulnerability is particularly serious as it can lead to a complete loss of administrative control over the Grafana instance.

NVD status

Status: Awaiting Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
grafana / grafana oss	`cpe:2.3:a:grafana:grafana_oss::::::::`