CVE-2026-15577
Received
Received - Intake
Incorrect Authorization in Grafana via Status Subresource Manipulation
Vulnerability report for CVE-2026-15577, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-13
Last updated on: 2026-10-13
Assigner: Grafana Labs
Description
Description
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Grafana | Grafana | Enterprise 12.4.0 |
| Grafana | Grafana | Enterprise 13.0.0 |
| Grafana | Grafana | Enterprise 13.1.0 |
| Grafana | Grafana | Enterprise 13.2.0 |
| Grafana | Grafana | OSS 12.4.0 |
| Grafana | Grafana | OSS 13.0.0 |
| Grafana | Grafana | OSS 13.1.0 |
| Grafana | Grafana | OSS 13.2.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
