This vulnerability in Grafana OSS allows a user whose permission to mint tokens for a service account has been revoked to continue minting tokens for a few seconds after revocation. The issue is a timing window during which access control changes are not immediately enforced, potentially allowing unauthorized token minting briefly. The vulnerability is categorized under CWE-284 (Improper Access Control) and has a CVSS 3.1 base score of 5.9, indicating medium severity. No official patch or remediation level has been published by the vendor at this time.

An attacker or user who has had their token minting permissions revoked may still mint tokens for a short time after revocation, potentially allowing unauthorized access or actions during this window. The confidentiality and integrity of the system could be impacted during this brief period. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be aware of this timing window and consider compensating controls such as minimizing the need for rapid permission revocations or monitoring token minting activities closely. No official fix or temporary workaround has been published by Grafana as of now.