Threats tagged 'ghsa-wpfw-6m34-pc8h'

This vulnerability affects independent Grafana instances that share the same rendering renderer_token. When the renderAuthJWT feature toggle is enabled (default from Grafana 13.0.0), an image renderer key issued by one instance is accepted by others sharing the token. This allows a user on one instance to impersonate a user with the same ID on another instance due to origin validation errors.