Exposing a New BOLA Vulnerability in Grafana
Summary: Unit 42 researchers discovered a Broken Object Level Authorization vulnerability, CVE-2024-1313 with a CVSS score of 6.5, affecting Grafana versions from 9.5.0 before 9.5.18, 10.0.0 before 10.0.13, 10.1.0 before 10.1.9, 10.2.0 before 10.2.6, and 10.3.0 before 10.3.5. The flaw lets low-privileged users or users with no organization affiliation delete dashboard snapshots belonging to other organizations via a DELETE request to /api/snapshots/{key}, since the snapshot key is not treated as a secret and appears in query parameters.
What's compelling: Grafana has over 20 million users worldwide, and the only precondition for deleting another organization's snapshot - including one created by a Grafana administrator - is knowing a key that is routinely exposed in URLs and endpoint query parameters.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-1313
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026