CVE-2026-15577
Fixed in a distro release EPSS <1%CVSS 6.5
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.
Products: Grafana Enterprise, Grafana OSS
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | percona-grafana | no fix |
| Red Hat hummingbird 1 | grafana12.4 | 0:12.4.12-0.5.hum1 |
| Red Hat hummingbird 1 | grafana13.2 | 0:13.2.4-0.1.hum1 |