Description

A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-11-06T10:16:37.943Z",
  "pubdate": "2026-11-06T10:16:37.943Z",
  "executiveSummary": "This vulnerability is classified as an authorization bypass flaw impacting the dashboard snapshot functionality within Grafana. The security defect allows unauthenticated users, low-privileged Viewers, and service accounts lacking explicit permissions to perform administrative-level operations on snapshots.\nSpecifically, the vulnerability enables unauthorized actors to create, publish to external endpoints, and delete sensitive dashboard snapshots. By bypassing the intended Access Control List (ACL) checks, attackers can gain unauthorized control over the lifecycle of these snapshots, potentially leading to unauthorized data disclosure or service disruption.\nThe scope of this vulnerability is limited to Grafana OSS and Grafana Enterprise version 12.4. Earlier versions and the subsequent Grafana 13 release remain unaffected. The risk is considered high due to the potential for unauthorized information exposure and the lack of requisite privileges needed to execute these sensitive actions.",
  "technicalDetails": "The root cause of the vulnerability lies in a failure of the authorization middleware to correctly validate user roles and permissions when processing API requests related to dashboard snapshots. In Grafana 12.4, the internal logic responsible for authorizing requests to snapshot endpoints fails to enforce the standard security constraints that typically restrict snapshot management to users with higher-level organizational permissions.\nThe attack flow proceeds as follows: An attacker, authenticated as a Viewer or holding a service account with minimal to no permissions, crafts a standard HTTP POST or DELETE request directed at the snapshot management API. Because the application fails to perform a rigorous check against the User-Role mapping or the specific resource permissions, the request is accepted by the server. An attacker can create a new snapshot of an existing dashboard, publish that snapshot to an external destination, or purge existing snapshots from the system.\nThe component responsible for the authorization check fails to inspect the security context of the incoming session object effectively. Consequently, any user with access to the dashboard environment is permitted to invoke the snapshot API methods. This bypass allows for the exfiltration of sensitive visualization data by publishing snapshots to external, potentially attacker-controlled, instances or external locations.\nThe exploitation is non-invasive and does not require complex payloads; it simply leverages existing legitimate API functions that are improperly gated. The post-exploitation impact includes the loss of confidentiality regarding internal telemetry and dashboard configurations, as snapshots are often shared under the assumption of restricted access. Furthermore, the ability to delete snapshots provides an attacker with a vector for localized denial-of-service, whereby they can systematically purge dashboard records and historical states to disrupt operational monitoring and incident response capabilities within the Grafana environment.\nThis vulnerability specifically targets the API layer of Grafana 12.4. The lack of proper authorization headers or middleware verification at the snapshot endpoint allows these unauthorized commands to reach the backend services, where they are executed with the same underlying system privileges as an authenticated administrator, effectively elevating the privileges of the attacker to perform these sensitive lifecycle management tasks."
}