Back to Database
Status published
Medium
CVE-2023-6152
A user changing their email after signing up and verifying...
Vulnerability Description
A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-6152
Credits & Attribution
No credits recorded in the NVD database.
References
More from Grafana
View All →CVE-2025-8341
SSRF in Infinity Datasource Plugin
Medium
5
CVE-2025-6197
An open redirect vulnerability has been identified in Grafana OSS...
Medium
4.2
CVE-2025-6023
An open redirect vulnerability has been identified in Grafana OSS...
High
7.6
CVE-2025-4123
A cross-site scripting (XSS) vulnerability exists in Grafana caused by...
High
7.6
CVE-2025-41118
Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection
Critical
9.1
Affected Vendor
Grafana
View all reports →Affected Software
Grafana, Grafana Enterprise
Vulnerable Versions:
2.5.0, 10.0.0, 10.1.0, 10.2.0, 10.3.0
Timeline
Official Publish:
February 13th, 2024
Last Modified:
February 15th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L