This vulnerability in Grafana OSS allows a user whose permission to mint tokens for a service account has been revoked to continue minting tokens for a few seconds after the revocation event. The issue affects several versions from 9.2.0 through 13.0.1. The CVSS 3.1 base score is 5.9, indicating medium severity, with network attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity but no impact on availability. The vulnerability is published but lacks an official remediation level or patch information.

An attacker or user with previously granted privileges may mint tokens for a short window after their access is revoked, potentially allowing temporary unauthorized access or actions. However, this access is transient and eventually revoked, limiting the window of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor for updates from Grafana and consider implementing compensating controls to reduce the risk during the brief token minting window after access revocation.