{"id":"CVE-2026-15577","aliases":["ALPINE-CVE-2026-15577","BIT-grafana-2026-15577","EUVD-2026-98904","GHSA-pm7c-5ghp-r9fq","RHSA-2026:84422","RHSA-2026:85544"],"status":"published","title":"Git Sync connection configuration can be modified with read-only access","description":"A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00269,"percentile":0.19316,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-10-13T17:05:49Z","modified":"2026-11-04T22:30:02Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"grafana","fixed_in":["12.4.14-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"grafana","fixed_in":["12.4.13","13.0.11","13.1.8","13.2.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.14-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"12.4.0"},{"fixed":"12.4.13"},{"introduced":"13.0.0"},{"fixed":"13.0.11"},{"introduced":"13.1.0"},{"fixed":"13.1.8"},{"introduced":"13.2.0"},{"fixed":"13.2.4"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.12-0.5.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.4-0.1.hum1"}]}],"bundled":4}],"products":[{"vendor":"grafana","product":"grafana enterprise"},{"vendor":"grafana","product":"grafana oss"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-15577","tags":["vendor-advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15577","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-pm7c-5ghp-r9fq"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-15577","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84422","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-109955","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15577","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33374","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84422.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550704","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15577","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550703","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33374","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33374","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-33374","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550544","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-109955","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109955","tags":["advisory"]},{"url":"https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/hono-4.12.4-before-4.13.11-middleware-bypass-via-servestatic-double-decoding","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:85544","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-95502","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93294","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_85544.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550715","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93294","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93294","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-93294","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550709","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-95502","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95502","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-95502","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2026-15577","title":"Git Sync connection configuration can be modified with read-only access","description":"A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.","status":"published","published":"2026-10-13T17:05:49.743Z","modified":"2026-10-13T19:31:30.11Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:47:39.876248Z"}],"euvd":[{"id":"EUVD-2026-98904","description":"A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.","status":"published","published":"2026-10-13T17:05:49Z","modified":"2026-10-13T19:31:30Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:18.769576Z"}],"ghsa":[{"id":"GHSA-pm7c-5ghp-r9fq","title":"A user or service account with read-only access to Git Sync (provisioning) connections can modify...","description":"A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.","status":"published","published":"2026-10-13T18:30:58Z","modified":"2026-10-13T18:31:04Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:13:12.080152Z"}],"nvd":[{"id":"CVE-2026-15577","description":"A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.","status":"published","published":"2026-10-13T18:17:23.073Z","modified":"2026-10-16T20:02:37.63Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:57.132005Z"}],"osv":[{"id":"ALPINE-CVE-2026-15577","description":"A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.","status":"published","published":"2026-10-13T18:17:23.073Z","modified":"2026-11-04T22:30:02.826130073Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-04T22:39:43.298532Z"},{"id":"RHSA-2026:84422","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-10-18T10:05:17Z","modified":"2026-10-20T10:43:36.873571341Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:85544","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-20T10:18:13Z","modified":"2026-10-20T10:32:25.283153784Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"BIT-grafana-2026-15577","title":"Git Sync connection configuration can be modified with read-only access","description":"A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.","status":"published","published":"2026-10-20T08:44:25.787Z","modified":"2026-10-20T10:30:03.598652467Z","updated_at":"2026-11-02T15:28:31.02759Z"}]}}