A vulnerability in Grafana Tempo Operator prior to version 0.16.0 allows a user with full access to their namespace to extract the ServiceAccount token created by the operator. This token can be used to submit TokenReview and SubjectAccessReview requests, potentially exposing information about other users' permissions. The flaw does not allow privilege escalation or impersonation but may aid attackers in gathering information for further attacks. The issue is fixed in version 0.16.0.