VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Oct 13, 2022· Updated Jun 17, 2026

CVE-2022-39229

CVE-2022-39229

Description

Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. A user can have an email address as a username. However, the login system allows users to log in with either username or email address. Since Grafana allows a user to log in with either their username or email address, this creates an usual behavior where user_1 can register with one email address and user_2 can register their username as user_1’s email address. This prevents user_1 logging into the application since user_1's password won’t match with user_2's email address. Versions 9.1.8 and 8.5.14 contain a patch. There are no workarounds for this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/grafana/grafanaGo
< 8.5.148.5.14
github.com/grafana/grafanaGo
>= 9.0.0, < 9.1.89.1.8

Affected products

81

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.