medium6.5
CVE-2026-15577
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (…
Impact
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.