CVE-2018-15727 Public exploit EPSS 64.3%

Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.

Summary

The flaw lies in Grafana's authentication handling for its 2.x, 3.x and 4.x releases before 4.6.4 and its 5.x releases before 5.2.3, where the "remember me" cookie can be forged.

Heading is the official description · CVE.org

Breakdown

24.8 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Public exploit code (PoC-in-GitHub) was available the same day.

DisclosedPublic exploit codePoC-in-GitHub29 Aug 2018day 0

See the family tree

4 related vulnerabilities in the same code over 7 years. The latest fix listed for github.com/grafana/grafana is 6.0.0-beta1+incompatible.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

This CVECVE-2018-15727Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3…29 Aug 2018
relatedMedium
Why these are linked:
- Same code patched: migrator.go (machine-matched)Functions: Startcommit 7baecf0 commit df83bf1 commit 1024480
CVE-2020-12458An information-disclosure flaw was found in Grafana through…29 Apr 2020
same family
CVE-2020-12459In certain Red Hat packages for Grafana 6.x through 6.3.6, the…29 Apr 2020
same family
CVE-2025-41115Incorrect privilege assignment21 Nov 2025

Fixes in github.com/grafana/grafanaGo package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

1.9.2-0.20260513165311-fb7336fc36c1CVE-2026-3338013 May 2026
1.9.2-0.20260513165311-fb7336fc36c1CVE-2026-3338113 May 2026
5.2.0-beta1+incompatibleCVE-2018-1209911 Jun 2018
5.2.3+incompatibleCVE-2018-1572729 Aug 2018
5.3.2CVE-2018-100081620 Dec 2018
6.0.0-beta1+incompatibleCVE-2018-186232 Jun 2020
6.0.0-beta1+incompatibleCVE-2018-186252 Jun 2020Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: github.com/grafana/grafana.

Gogithub.com/grafana/grafanaGHSA-rgjg-66cx-5x9m GO-2022-0707

Upgrade to 5.2.3

Still affected on this line by CVE-2020-13379 (fixed in 6.7.4, a newer line); CVE-2021-39226 (fixed in 7.5.11, a newer line); CVE-2022-31097 (no fix published); CVE-2024-9264 (no fix published); CVE-2025-3415 (no fix published); CVE-2025-4123 (no fix published); CVE-2025-6023 (no fix published).

Gogo get github.com/grafana/grafana@v5.2.3

The first fix for CVE-2018-15727.

Affected versions, by release line

If you run	Upgrade to
5.0.0 up to 5.2.3	5.2.3
5.0.0+incompatible up to 5.2.3+incompatible Still affected on this line by CVE-2020-13379 (fixed in 6.7.4, a newer line); CVE-2021-39226 (fixed in 7.5.11, a newer line); CVE-2022-31097 (no fix published); CVE-2024-9264 (no fix published); CVE-2025-3415 (no fix published); CVE-2025-4123 (no fix published); CVE-2025-6023 (no fix published).	5.2.3+incompatible
All versions before 4.6.4 Still affected on this line by CVE-2020-13379 (fixed in 6.7.4, a newer line); CVE-2021-39226 (fixed in 7.5.11, a newer line); CVE-2022-31097 (no fix published); CVE-2024-9264 (no fix published); CVE-2025-3415 (no fix published); CVE-2025-4123 (no fix published); CVE-2025-6023 (no fix published).	4.6.4
All versions before 4.6.4+incompatible Still affected on this line by CVE-2020-13379 (fixed in 6.7.4, a newer line); CVE-2021-39226 (fixed in 7.5.11, a newer line); CVE-2022-31097 (no fix published); CVE-2024-9264 (no fix published); CVE-2025-3415 (no fix published); CVE-2025-4123 (no fix published); CVE-2025-6023 (no fix published).	4.6.4+incompatible

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

4 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2022-1171

Public exploitAdvisories link exploit code.

, 30 Oct 2026

64.3%Top 0.77%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.23%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9923 19.9/20

Threat reports0 reports 0.0/10

Public exploit code1 PoC-in-GitHub repo; 1 Metasploit module 5.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total24.8

Record

Published: 29 Aug 2018
Modified: 5 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in github.com/grafana/grafanaGo package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

References

vdb-entry 1

vendor-advisory 2

x_refsource_CONFIRM 1

techniques