A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status… (CVE-2026-15577)

This vulnerability (CVE-2026-15577) affects Grafana version 12.4 when the experimental provisioning feature is enabled. It allows a user or service account with only read-only permissions on Git Sync provisioning connections to modify the connection's configuration through the status subresource due to improper authorization enforcement. The CVSS 3.1 score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, and limited privileges required but no user interaction needed. There is no indication of confidentiality or availability impact, but integrity is impacted.

An attacker with read-only access to Git Sync provisioning connections can escalate their privileges to modify connection configurations, potentially leading to unauthorized changes in the provisioning setup. This could affect the integrity of the system configuration but does not impact confidentiality or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the experimental provisioning feature toggle and limit read-only permissions on Git Sync provisioning connections to trusted users only.