Grafana 12.4 Dashboard Snapshot Auth Bypass
CVE-2026-33379 Published on November 6, 2026
Dashboard snapshot permission bypass
A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-33379 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-33379
Want to know whenever a new CVE is published for Grafana Labs Grafana? stack.watch will email you.
Affected Versions
Grafana OSS:- Version 12.4.0 and below 12.4.4 is affected.
- Version 12.4.0 and below 12.4.4 is affected.