CVE-2026-15577

A flaw was found in Grafana. An improper authorization vulnerability allows an authenticated user or service account with read-only access to modify Git Sync connection configurations through the status subresource. Consequently, an attacker can make unauthorized configuration changes despite lacking administrative or write permissions.

This issue is rated Moderate. An authenticated user or service account that only has read access to Git Sync (provisioning) connections can change a connection's configuration through the status subresource because of incorrect authorization. Impact is integrity of Git Sync configuration only; confidentiality and availability are not affected. On Grafana 12.4 the vulnerable API is available only when the experimental provisioning feature toggle is enabled.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If Git Sync / experimental provisioning is not required, disable it so the vulnerable status API is not exposed. Restrict Grafana network access to trusted administrators. Minimize identities granted even read access to Git Sync connections and audit connection settings after suspicious activity.