This vulnerability in Grafana OSS allows a user with Editor role and write access to a dashboard to overwrite dashboards they do not own, resulting in privilege escalation to admin on those dashboards. The issue is due to insufficient access control checks that fail to restrict dashboard ownership changes properly. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, required privileges at the Editor level, no user interaction, unchanged scope, limited confidentiality impact, high integrity impact, and no availability impact. No known exploits are reported in the wild, and no official remediation or patch has been disclosed as of the publication date.

An Editor with write access to a dashboard can escalate privileges to admin on that dashboard by overwriting it, potentially allowing unauthorized administrative actions on that dashboard. The impact is limited to dashboards where the user already has write access and does not affect the entire Grafana instance or other dashboards without such access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Editor role assignments and write access to dashboards to trusted users only to minimize risk.