Grafana Alerting DingDing Integration Improper Authorization Vulnerability

A vulnerability allowing unauthorized access to Grafana Alerting DingDing integration has been identified. This issue arises from improper authorization, which could expose sensitive information to users with Viewer permissions. The vulnerability is present in Grafana versions prior to 11.6.2 and has been fixed in several subsequent releases. The issue specifically affects the administrative user interface for log management, not the Incoming Goods Suite user interface.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information within the Grafana Alerting DingDing integration, allowing users with Viewer permissions to access data they should not be privy to.

Remediation

Users are strongly recommended to upgrade to Grafana versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 or 12.0.1+security-01.