IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
8.5Alta

CVE-2026-33379Dashboard snapshot permission bypass

Grafana Grafana OSS; Grafana Grafana Enterprise Publicada: (hace 5 días)

Descripción

A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not.

Debilidad (CWE): CWE-862

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
Grafana Grafana Enterprise 12.4.0 – < 12.4.4
Grafana Grafana OSS 12.4.0 – < 12.4.4

Referencias y parches

CVE recientes del mismo producto — Grafana

5.5Media
CVE-2026-110289

Git Sync connections send credentials to unvalidated server URLs

Grafana Grafana Enterprise; Grafana Grafana OSS

A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private…

7.1Alta
CVE-2026-102589

Cross-instance user impersonation through image renderer JWTs

Grafana Grafana OSS; Grafana Grafana Enterprise

When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This a…

7.1Alta
CVE-2026-111024

Folder permission bypass in the Git Sync repository files API

Grafana Grafana Enterprise; Grafana Grafana OSS

A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned da…

7.1Alta
CVE-2026-111000

Privilege escalation through folder move in the folders API

Grafana Grafana Enterprise; Grafana Grafana OSS

A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move AP…

6.5Media
CVE-2026-107509

Memory exhaustion denial of service in SQL Expressions

Grafana Grafana OSS; Grafana Grafana Enterprise

A user with the Viewer role can make Grafana allocate an unbounded amount of memory, and crash it, with a single SQL Expression query that casts a value to a very large BINARY length (memory allocation with excessive size value).

6.5Media
CVE-2026-110992

Path traversal in Git Sync delete and move jobs

Grafana Grafana OSS; Grafana Grafana Enterprise

A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outside the configured repository path with a job that references a resource whose source path contains ../ sequences (path traversal). With a local files…