CVE-2026-15577
published 2026-10-13CVE-2026-15577: A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource…
PriorityP342medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
0.27%
17.8th percentile
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana | — | — |
| grafana | grafana_enterprise | >= 12.4.0 < 12.4.13 | 12.4.13 |
| grafana | grafana_enterprise | >= 13.0.0 < 13.0.11 | 13.0.11 |
| grafana | grafana_enterprise | >= 13.1.0 < 13.1.8 | 13.1.8 |
| grafana | grafana_enterprise | >= 13.2.0 < 13.2.4 | 13.2.4 |
| grafana | grafana_oss | >= 12.4.0 < 12.4.13 | 12.4.13 |
| grafana | grafana_oss | >= 13.0.0 < 13.0.11 | 13.0.11 |
| grafana | grafana_oss | >= 13.1.0 < 13.1.8 | 13.1.8 |
| grafana | grafana_oss | >= 13.2.0 < 13.2.4 | 13.2.4 |
| multicluster-globalhub | multicluster-globalhub-grafana-rhel9 | — | — |
| rhacm2 | acm-grafana-rhel9 | — | — |
| rhceph | grafana-rhel10 | — | — |
| rhceph | grafana-rhel9 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
grafana: Grafana: Unauthorized configuration modification via status subresource
vendor_redhat·2026-10-13·CVSS 6.5
CVE-2026-15577 [MEDIUM] CWE-425 grafana: Grafana: Unauthorized configuration modification via status subresource
grafana: Grafana: Unauthorized configuration modification via status subresource
A flaw was found in Grafana. An improper authorization vulnerability allows an authenticated user or service account with read-only access to modify Git Sync connection configurations through the status subresource. Consequently, an attacker can make unauthorized configuration changes despite lacking administrative or write permissions.
Package: multicluster-globalhub/multicluster-globalhub-grafana-rhel9 (Multicluster Global Hub) - Fix deferred
Package: rhacm2/acm-grafana-rhel9 (Red Hat Advanced Cluster Management for Kubernetes 2) - Fix deferred
Package: rhceph/grafana-rhel9 (Red Hat Ceph Storage 7) - Fix deferred
Package: rhceph/grafana-rhel9 (Red Hat Ceph Storage 8) - Fix deferred
Package: rhceph/graf
GHSA
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization).
ghsa_unreviewed·2026-10-13
CVE-2026-15577 [MEDIUM] CWE-863 A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization).
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.
No detection rules found.
No public exploits indexed.
2026-10-13
Published