The Grafana dashboard permissions API fails to verify the specific dashboard scope and only checks for the dashboards.permissions:* action. Consequently, a user who has permission management rights on one dashboard can escalate privileges internally by reading and modifying permissions on other dashboards. This is an authorization bypass vulnerability classified under CWE-863 and CWE-639. The CVSS v3.1 base score is 8.1 (high severity) with network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Red Hat has released security updates for affected Grafana packages in their Enterprise Linux 10.0 Extended Update Support and related variants, providing an official fix.

An attacker with permission management rights on a single dashboard can read and modify permissions on other dashboards within the same organization, leading to internal privilege escalation. This compromises confidentiality and integrity of dashboard permissions but does not affect availability. The vulnerability enables unauthorized access and modification of dashboard permissions beyond the attacker's original scope.

An official security update fixing this vulnerability is available from Red Hat for Grafana packages in Red Hat Enterprise Linux 10.0 Extended Update Support and related variants. Users should apply the provided update (e.g., grafana-10.2.6-20.el10_0) to remediate the issue. No alternative mitigations meeting Red Hat's criteria are currently available. Organizations should prioritize patching affected systems to prevent privilege escalation.