# CVE-2024-9476: Privilege escalation vulnerability for Organizations in Grafana

> CVE-2024-9476: Privilege escalation vulnerability for Organizations in Grafana. CVSS 5.1 (CVSS 4.0).

Canonical: https://rewindex.com/cve/CVE-2024-9476
Last updated: 2026-06-17T08:24:39Z

- Published: 2024-11-13 16:30 UTC · Updated: 2026-06-17 08:24 UTC · Assigner: GRAFANA
- CVSS: 5.1 (CVSS 4.0) · Severity: Medium
- EPSS: 0.21%, 11th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-266

## Description

A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.This vulnerability will only affect users who utilize the Organizations feature to isolate resources on their Grafana instance.

## Affected vendors and products

- Grafana Labs: Grafana OSS and Enterprise

## Tracked companies

- [Grafana Cloud](https://rewindex.com/company/grafana-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2024-9476)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2024-9476)
- [https://grafana.com/blog/2024/11/12/grafana-security-release-medium-severity-security-fix-for-cve-2024-9476/](https://grafana.com/blog/2024/11/12/grafana-security-release-medium-severity-security-fix-for-cve-2024-9476/)
- [https://grafana.com/security/security-advisories/cve-2024-9476/](https://grafana.com/security/security-advisories/cve-2024-9476/)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2024-9476 · Markdown: https://rewindex.com/cve/CVE-2024-9476.md · JSON: https://rewindex.com/api/v1/cves/CVE-2024-9476 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:13:20.321Z