Grafana EUVD-2026-89456

Exploitation requires: (1) a dashboard that was configured as a shared/public dashboard and then PAUSED (not deleted - deleting the share correctly revokes the token); (2) the attacker possessing the still-valid public share link/token; and (3) for credential disclosure specifically, one or more data sources configured to use browser (direct) access mode, whose stored credentials are then exposed. No authentication and no user interaction are needed (PR:N/UI:N) against a reachable Grafana instance, but the pause-not-delete state and non-default browser-access data-source mode materially narrow real-world exposure; instances with only server-access data sources leak configuration but not the same stored credentials.

This is a genuine but moderate-severity authorization flaw, not an inflated high-CVSS finding. The CVSS 3.1 base vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3) is internally consistent with the description: a network-reachable, unauthenticated, low-complexity information-disclosure bug with no integrity or availability impact. The most severe element - leakage of stored data-source credentials - is what makes this worth attention despite the medium score, since disclosed credentials can be pivoted against back-end data sources. However, several real-world limiters keep true risk moderate: it only affects dashboards that were both publicly shared AND then paused (deletion correctly revokes the token), and credential exposure is confined to data sources configured with browser (direct) access mode, which is non-default and increasingly deprecated in Grafana. No EPSS score, no CISA KEV listing, and no public exploit code are provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - consistent with a vendor self-reported advisory. Net: prioritize patching where public dashboards and browser-access data sources are in use, but this is not an emergency remote-code-execution class issue.

An organization publicly shares a Grafana dashboard, then later 'pauses' the share believing this cuts off access. An attacker who retained the original share link requests the frontend bootstrap endpoints and, without authenticating, receives the dashboard's data-source configuration - including stored credentials for any browser-access data sources - which can then be reused against those back-end systems. No public exploit code is identified at time of analysis; exploitation requires only possession of a previously-valid share link.