CVE-2022-39306

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins add members to the organization, non existing users get an email invite, existing members are added directly to the organization. When an invite link is sent, it allows users to sign up with whatever username/email address the user chooses and become a member of the organization. This introduces a vulnerability which can be used with malicious intent. This issue is patched in version 9.2.4, and has been backported to 8.5.15. There are no known workarounds.

• CWE-20
• CWE-20

• https://github.com/grafana/grafana/security/advisories/GHSA-2x6g-h2hg-rq84Patch, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20221215-0004/Third Party Advisory
• https://github.com/grafana/grafana/security/advisories/GHSA-2x6g-h2hg-rq84Patch, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20221215-0004/Third Party Advisory

Published

Nov 9, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39300node SAML is a SAML 2.0 library based on the SAML implementa…8.1
• CVE-2022-39301sra-admin is a background rights management system that sepa…5.4
• CVE-2022-39302Ree6 is a moderation bot. This vulnerability would allow oth…5.4
• CVE-2022-39303Ree6 is a moderation bot. This vulnerability allows manipula…9.8
• CVE-2022-39304ghinstallation provides transport, which implements http.Rou…4.7
• CVE-2022-39305Gin-vue-admin is a backstage management system based on vue …9.8
• CVE-2022-39307Grafana is an open-source platform for monitoring and observ…5.3
• CVE-2022-39308GoCD is a continuous delivery server. GoCD helps you automat…5.9
• CVE-2022-39309GoCD is a continuous delivery server. GoCD helps you automat…6.5
• CVE-2022-3931Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-39310GoCD is a continuous delivery server. GoCD helps you automat…6.5
• CVE-2022-39311GoCD is a continuous delivery server. GoCD helps you automat…8.8