CVE catalog

CVE-2018-15727

UBUNTU-CVE-2018-15727

Severity: High · CVSS 8.2CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Published: Aug 29, 2018, 12:00:00 AM UTC
Updated: Oct 24, 2025, 4:47:11 AM UTC
Source: [NVD] · [CVE record]
EPSS: 64.28% · Oct 27, 2026

Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Ubuntu	grafana	16.04	`2.6.0+dfsg-1`	vulnerable

Fixed-version evidence

OpenFactory catalog packages

No matching packages in this catalog.

Observed: Oct 23, 2026, 5:34:57 PM UTC

References

[https://ftp.suse.com/pub/projects/security/csaf/suse-su-2019_2671-1.json]
[https://osv.dev/vulnerability/UBUNTU-CVE-2018-15727]
[https://security.access.redhat.com/data/csaf/v2/vex/2018/cve-2018-15727.json]

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]