Grafana OSS CVE-2026-33377

The attacker must hold a valid Grafana OSS account with the Editor role and must already have write access to the specific target dashboard (granted directly, by team membership, or by folder permissions). Exploitation is scoped to that single dashboard - it does not yield org-admin or server-admin and does not affect dashboards the Editor cannot write to - and requires Grafana OSS in an affected version (8.5.0-11.6.14, 12.0.0-12.2.8, 12.3.0-12.3.6, 12.4.0-12.4.3, or 13.0.0-13.0.1). No user interaction is required (UI:N). Single-tenant deployments where all Editors are already trusted to admin all dashboards face minimal practical risk.

Signals are mixed and lean toward a moderate, contextual risk rather than urgent. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N confirms remote, low-complexity exploitation by an authenticated low-privilege user with no user interaction, and high integrity impact (admin grant). However, EPSS is very low at 0.03% (8th percentile), CISA SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial, and the vulnerability is not on the CISA KEV list. The blast radius is bounded - escalation is scoped to a single dashboard (Scope:Unchanged), not the Grafana instance - which aligns with the 'partial' technical impact. Real-world priority is highest for multi-tenant Grafana OSS deployments where Editors are not trusted to administer arbitrary dashboards; for single-team deployments where Editors are already trusted, exposure is largely organizational.

An attacker holding Editor credentials in a shared Grafana OSS tenant identifies a sensitive dashboard owned by another team to which they have been granted write access (for example, for collaborative editing). Using the dashboard overwrite operation, they trigger the flawed access-control path and obtain Admin permission on that dashboard, allowing them to change its viewers/editors, revoke the original owner's access, and pivot to silently alter what users see (queries, alert thresholds, panels). No public exploit identified at time of analysis.