A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status…
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Grafana Labs
- Product
- Grafana / Loki / Tempo / Mimir
- CVSS
- 6.5
- Exposure class
- Network management
Why it ranks 8 (Routine)
- CVSS 6.5 medium
- Product class: network management
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-15577 on this site · NVD · CVE.org · Vulnpedia