This vulnerability affects Grafana OSS instances configured with multiple organizations. An Org Admin user from one organization can exploit the GET /api/access-control/users/permissions/search?actionPrefix=dashboards: API endpoint to retrieve permission data belonging to other organizations within the same Grafana stack. The disclosed data is limited to dashboard and folder UIDs and per-user permission and scope mappings. Sensitive data such as dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. The issue represents a limited cross-organization information disclosure classified under CWE-863 (Incorrect Authorization).

The impact is limited to unauthorized disclosure of metadata about dashboards and folders, including identifiers and user permission mappings across organizations in a multi-org Grafana OSS deployment. No sensitive content or credentials are exposed. This could potentially aid an attacker in reconnaissance but does not directly expose confidential data or allow unauthorized modification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider restricting Org Admin privileges and carefully evaluating multi-organization configurations to minimize exposure.