The vulnerability in Grafana's dashboard permissions API arises because it does not properly verify the scope of the target dashboard when managing permissions. Instead, it only checks for the dashboards.permissions:* action, which enables a user with permission management rights on one dashboard to escalate privileges by reading and modifying permissions on other dashboards. This is an authorization bypass (CWE-639) leading to organization-internal privilege escalation. The vulnerability has a CVSS v3.1 base score of 8.1 (high severity) with network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Red Hat has released security updates for affected Grafana packages in Red Hat Enterprise Linux 10.0 Extended Update Support and related variants, providing an official fix.

An attacker with permission management rights on a single Grafana dashboard can bypass authorization checks to read and modify permissions on other dashboards within the same organization. This leads to an internal privilege escalation, potentially exposing sensitive dashboard configurations and allowing unauthorized permission changes. The confidentiality and integrity of dashboard data are highly impacted, but availability is not affected. There are no known exploits in the wild at this time.

An official security update fixing this vulnerability is available from Red Hat for affected Grafana packages. Users should apply the update as provided in Red Hat Enterprise Linux 10.0 Extended Update Support and related product variants. Currently, no alternative mitigations meeting Red Hat's criteria for ease of use, applicability, and stability are available. Users should follow vendor guidance and update to the fixed package versions promptly.