This vulnerability in Grafana's public dashboards occurs because the annotation timerange was not limited to the locked timerange set on the dashboard. As a result, an attacker or user with access to the public dashboard could read all annotations visible on that dashboard, even those outside the locked timerange. The issue does not expose any annotations that were not already visible on the public dashboard, thus limiting the scope of information disclosure. The CVSS v3.1 base score is 5.3, reflecting a medium severity with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact.

The impact is limited to information disclosure of annotations on public Grafana dashboards beyond the locked timerange. No integrity or availability impacts are reported. No annotations outside those already visible on the public dashboard are leaked, so the exposure is constrained to data already accessible to the public dashboard viewers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or vendor advisories are provided, users should monitor official Grafana channels for updates. Until a fix is available, consider disabling annotations on public dashboards or restricting dashboard access to trusted users to mitigate exposure.