CVE-2024-6322: 
Grafana vulnerability analysis and mitigation

A privilege escalation vulnerability was identified in Grafana's plugin data source access control system. The vulnerability (CVE-2024-6322) was discovered and disclosed on August 20, 2024, affecting Grafana's plugin system where access control protected by the ReqActions json field in plugin.json could be bypassed (Grafana Advisory, NVD).

The vulnerability stems from an improper implementation of access control mechanisms where the ReqActions check was not properly scoped to specific datasources. This allowed users or service accounts with access to any data source to bypass access controls for other protected plugin data sources. The vulnerability has been assigned a CVSS v3.1 base score of 4.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L, indicating a network-accessible vulnerability requiring high privileges and high attack complexity (NVD).

The vulnerability allows authenticated users with access to any data source to potentially bypass access controls for other protected plugin data sources. However, the impact is limited as the account must already have prior query access to the impacted datasource (NVD).