Grafana EUVD-2026-82430

Requires an authenticated account with at least the Editor role in a Grafana org (PR:L) - not exploitable anonymously. The attacker must configure a Geomap panel using the MapLibre base layer and point it at a malicious, externally-hosted style configuration that carries attacker-controlled JavaScript. Exploitation completes only when a different, typically higher-privileged user (e.g., Org Admin) renders that panel (UI:R), at which point the stored script runs in their session and enables escalation to Org Admin. Limiting factors: needs Editor privileges, the ability to host/reach a malicious style config, victim interaction viewing the panel, and an affected version (Grafana OSS/Enterprise 12.3.0 through the listed 13.x ranges); patched releases remove the vector.

This is a genuine but privilege-gated stored XSS. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, 7.3 High) is internally consistent with the description: network-reachable, low complexity, but requiring an authenticated Editor-role account (PR:L) and victim interaction (UI:R) when a higher-privileged user renders the malicious Geomap panel. No EPSS score, SSVC decision data, KEV listing, or public POC was provided, so exploitation status is 'no public exploit identified at time of analysis' - this is not confirmed active exploitation. The real-world risk is moderate rather than critical: the C:H/I:H rating reflects session hijack and escalation to Org Admin, which is serious, but exploitation depends on an insider or compromised Editor account plus a victim admin viewing the crafted panel, which narrows the practical attack surface versus an unauthenticated RCE. Because a patch is available (per the Grafana advisory) and Grafana is extremely widely deployed, this warrants prompt patching in multi-tenant/multi-user Grafana instances where Editors are less trusted than Admins, but it is not an internet-wide drive-by threat.

A user holding only the Editor role in a Grafana org creates or edits a Geomap panel, setting its MapLibre base layer to a malicious externally-hosted style configuration containing attacker JavaScript. When an Org Admin (or other higher-privileged user) opens the dashboard, the script executes in their authenticated session, allowing the attacker to hijack that session and escalate to Org Admin. No public exploit code is identified at the time of analysis; exploitation requires the victim to view the panel (UI:R).