CVE-2026-22640
BaseFortify
Publication date: 2026-01-15
Last updated on: 2026-01-15
Assigner: SICK AG
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| grafana | grafana | From 11.5.0 (exc) |
| grafana | grafana | From 12.0.2 (inc) |
| grafana | grafana | From 11.6.3 (inc) |
| grafana | grafana | From 11.5.6 (inc) |
| grafana | grafana | From 11.4.6 (inc) |
| grafana | grafana | From 11.3.8 (inc) |
| sick | sick_incoming_goods_suite | From 1.2.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an access control flaw in Grafana OSS where an Organization administrator can permanently delete the Server administrator account using the DELETE /api/org/users/ endpoint. It can be exploited if an Organization administrator exists and the Server administrator is either not part of any organization or part of the same organization as the Organization administrator. This leads to the potential removal of the only Server administrator, making the Grafana instance unmanageable and resulting in a complete loss of administrative control.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediate steps include restricting the privileges of Organization administrators to prevent unauthorized deletion of Server administrator accounts, ensuring that Server administrators are part of organizations to avoid exposure, and implementing strict access controls and network segmentation to limit attack vectors. Additionally, monitoring and controlling access to the DELETE /api/org/users/ endpoint is critical. Following best cybersecurity practices such as those outlined in SICK's Operating Guidelines, including network segmentation, use of firewalls, and access control measures, will help reduce risk. Contacting SICK PSIRT for any available patches or advisories and applying them promptly is also recommended. [5]
How can this vulnerability impact me? :
The impact of this vulnerability is severe: Organization administrators can delete Server administrator accounts permanently. If the only Server administrator is deleted, the Grafana instance becomes unmanageable because no super-user permissions remain. This affects all users, organizations, and teams managed within the instance, potentially causing a total loss of administrative control over the system.