CVE-2026-15577

EUVD-2026-98904
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GRAFANACNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 17.78%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
grafanagrafana
12.4.0 ≤
𝑥
< 12.4.13
CNA
grafanagrafana
13.0.0 ≤
𝑥
< 13.0.11
CNA
grafanagrafana
13.1.0 ≤
𝑥
< 13.1.8
CNA
grafanagrafana
13.2.0 ≤
𝑥
< 13.2.4
CNA
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://grafana.com/security/security-advisories/cve-2026-15577