LiveActive security incident?Get immediate response
CVE Record

CVE-2022-31107: Grafana account takeover via OAuth vulnerability

Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana. Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user's Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.

HighCVSS 7.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Grafana deployments using OAuth can let an already-authorized OAuth user be logged into another Grafana user's account under specific account-linking conditions. The issue can expose dashboards, data sources, and administrative actions available to the victim. Patched Grafana releases are available, and workarounds exist for teams unable to upgrade immediately.

Executive priority

Treat this as a high-priority identity and monitoring-platform issue. Urgency is highest for externally reachable or shared Grafana instances using OAuth, especially where privileged dashboards or data sources are accessible through Grafana accounts.

Technical view

CVE-2022-31107 is a CWE-863 authorization flaw in Grafana's OAuth account linking. A malicious OAuth-authorized user whose external ID and email are not already linked in Grafana may be associated with a target internal account when the OAuth IdP supplies a matching login name.

Likely exposure

Exposure is likely where Grafana versions 5.3 through the vulnerable 9.0, 8.5, 8.4, or 8.3 branches use OAuth login and allow users whose OAuth identities are not pre-linked to Grafana accounts.

Exploitation context

The source bundle does not show CISA KEV listing or cited active exploitation. Exploitation requires an authorized OAuth user, an unlinked external ID and email, knowledge of the target Grafana username, and an OAuth IdP that provides login names.

Researcher notes

The important exposure boundary is not all Grafana installs; it is OAuth-enabled instances matching the vulnerable version ranges and account-linking preconditions. The public sources provide patch versions and workarounds, but no evidence of active exploitation in the supplied bundle.

Mitigation direction

  • Upgrade Grafana to 9.0.3, 8.5.9, 8.4.10, 8.3.10, or later supported releases.
  • Disable OAuth login temporarily if upgrade timing creates unacceptable account-takeover risk.
  • Ensure every OAuth-authorized user has a corresponding Grafana account linked to their email address.
  • Review Grafana's vendor advisory and release notes before applying environment-specific changes.

Validation and detection

  • Inventory Grafana versions and identify instances below the patched releases.
  • Confirm whether OAuth login is enabled on each Grafana instance.
  • Verify the OAuth IdP provides login names used by Grafana account linking.
  • Check that OAuth-authorized users have matching Grafana accounts linked by email.
  • Review authentication history for unexpected access to privileged or high-value Grafana accounts.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-863: Authorization and privilege behavior lookup

Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-31107 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.1CVSS 3.1HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L1.65.5Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.1High
CVSS 3.1 vector shape for CVE-2022-31107Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
grafanagrafana>= 5.3, < 8.3.10, >= 8.4.0, < 8.4.10, >= 8.5.0, < 8.5.9, >= 9.0.0, < 9.0.3Listed
Weakness

CWE details

CWE-863

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-863 · source CWE mapping

Incorrect Authorization

Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs