CVE-2026-15577
CVE-2026-15577 · Git Sync connection configuration can be modified with read-only access
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.
CVSS 6.5 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: applications
Affected products and versions
grafana
- Versions
- ≥ 12.4.0, < 12.4.13: Affected (semver)
- ≥ 13.0.0, < 13.0.11: Affected (semver)
- ≥ 13.1.0, < 13.1.8: Affected (semver)
- ≥ 13.2.0, < 13.2.4: Affected (semver)
Update to 12.4.13; Update to 13.0.11; Update to 13.1.8; Update to 13.2.4