Executive Summary

This vulnerability is an access control flaw in Grafana OSS where an Organization administrator can permanently delete the Server administrator account using the DELETE /api/org/users/ endpoint. It can be exploited if an Organization administrator exists and the Server administrator is either not part of any organization or part of the same organization as the Organization administrator. This leads to the potential removal of the only Server administrator, making the Grafana instance unmanageable and resulting in a complete loss of administrative control.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediate steps include restricting the privileges of Organization administrators to prevent unauthorized deletion of Server administrator accounts, ensuring that Server administrators are part of organizations to avoid exposure, and implementing strict access controls and network segmentation to limit attack vectors. Additionally, monitoring and controlling access to the DELETE /api/org/users/ endpoint is critical. Following best cybersecurity practices such as those outlined in SICK's Operating Guidelines, including network segmentation, use of firewalls, and access control measures, will help reduce risk. Contacting SICK PSIRT for any available patches or advisories and applying them promptly is also recommended. [5]

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is severe: Organization administrators can delete Server administrator accounts permanently. If the only Server administrator is deleted, the Grafana instance becomes unmanageable because no super-user permissions remain. This affects all users, organizations, and teams managed within the instance, potentially causing a total loss of administrative control over the system.

Useful 0 Not Useful 0