Skip to content
Fencer Vulns
high 7.1

CVE-2021-27962 json

Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a…

published 2021-03-22 5 y ago modified 2026-09-08 2 mo ago also BIT-grafana-2021-27962 , EUVD-2021-14680

cvss
7.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.1%
EPSS 2.1% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a data source they should not be able to access.

Patch / fix

  • bitnami grafana 7.3.10, 7.4.5
  • grafana grafana 7.3.10, 7.4.5
  • rhnlib Manager Client Tools 15 4.2.4-3.28.1
  • ansible Manager Client Tools 15 2.9.21-1.5.1
  • mgr-cfg Manager Client Tools 15 4.2.3-1.18.1
  • mgr-osad Manager Client Tools 15 4.2.6-1.30.1
  • mgr-push Manager Client Tools 15 4.2.3-1.12.1
  • spacecmd Manager Client Tools 15 4.2.11-3.62.1
  • spacewalk-koan Manager Client Tools 15 4.2.4-3.21.1
  • dracut-saltboot Manager Client Tools 15 0.1.1627546504.96a0b3e-1.27.1

suse advisories SUSE-SU-2021:2675-1SUSE-SU-2021:2673-1SUSE-SU-2021:2660-1

  • grafana openSUSE Tumbleweed 7.5.7-1.2
  • ansible openSUSE Leap 15.2 2.9.21-lp152.2.7.1
  • dracut-saltboot openSUSE Leap 15.2 0.1.1627546504.96a0b3e-lp152.2.26.1
  • golang-github-prometheus-prometheus openSUSE Leap 15.2 2.27.1-lp152.3.13.1
  • grafana openSUSE Leap 15.2 7.5.7-lp152.2.16.1
  • rhnlib openSUSE Leap 15.3 4.2.4-3.28.1
  • ansible openSUSE Leap 15.3 2.9.21-1.5.1
  • mgr-cfg openSUSE Leap 15.3 4.2.3-1.18.1

opensuse advisories openSUSE-SU-2024:10818-1openSUSE-SU-2021:1162-1openSUSE-SU-2021:1148-1openSUSE-SU-2021:2675-1openSUSE-SU-2021:2662-1

  • grafana Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 7.4.5-r0

alpine advisories ALPINE-CVE-2021-27962

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-27962 updated cvss 6.8

grafana: users with editor role allows to bypass data source permissions

  • Red Hat Ceph Storage 2 grafana
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Service Mesh 1 servicemesh-grafana, servicemesh-grafana-prometheus Red Hat OpenShift Service Mesh 2.0 servicemesh-grafana, servicemesh-grafana-prometheus Red Hat Advanced Cluster Management for Kubernetes 2 grafana Red Hat Ceph Storage 3 grafana, grafana-container Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8 Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +8 more
    +4 more products
    Red Hat Enterprise Linux 9 grafana, grafana-selinux Red Hat OpenShift Container Platform 3.11 openshift3/grafana Red Hat OpenShift Container Platform 4 openshift4/ose-grafana Red Hat Storage 3 grafana
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.07% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
NVD 2.0 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N
OSV 3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Affected packages

ecosystem package affected fixed in
bitnami grafana
>=7.2.0, <7.3.10
>=7.4.0, <7.4.5
7.3.10
7.4.5

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.