CVE-2026-15577: CWE-863 in Grafana Grafana Enterprise

CVE-2026-15577 is an authorization bypass vulnerability (CWE-863) in Grafana Enterprise. It allows a user or service account with read-only access to Git Sync (provisioning) connections to modify a connection's configuration through its status subresource. On Grafana version 12.4, the affected API is only accessible if the experimental provisioning feature toggle is enabled. The vulnerability affects multiple version ranges: >=12.4.0 <12.4.13, >=13.0.0 <13.0.11, >=13.1.0 <13.1.8, and >=13.2.0 <13.2.4. The CVSS 3.1 base score is 6.5, with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker with read-only access to Git Sync provisioning connections can modify connection configurations, compromising the integrity of the system. There is no impact on confidentiality or availability. This could lead to unauthorized changes in provisioning configurations, potentially affecting system behavior or deployment processes.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the Grafana vendor advisory for current remediation guidance. Users should consider disabling the experimental provisioning feature toggle if not required, as the affected API is only available when this toggle is enabled. Monitor vendor communications for patches addressing this vulnerability.