Grafana 12.4 R/O User Overwrites Conn Conf via Status Subresource
CVE-2026-15577 Published on October 13, 2026
Git Sync connection configuration can be modified with read-only access
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-15577 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-15577
Want to know whenever a new CVE is published for Grafana Labs Grafana? stack.watch will email you.
Affected Versions
Grafana Enterprise:- Version 12.4.0 and below 12.4.13 is affected.
- Version 13.0.0 and below 13.0.11 is affected.
- Version 13.1.0 and below 13.1.8 is affected.
- Version 13.2.0 and below 13.2.4 is affected.
- Version 12.4.0 and below 12.4.13 is affected.
- Version 13.0.0 and below 13.0.11 is affected.
- Version 13.1.0 and below 13.1.8 is affected.
- Version 13.2.0 and below 13.2.4 is affected.