Grafana EUVD-2026-89774

Requires a valid authenticated Grafana account (any low-privilege user) and use of the alert rules API list endpoint. Two triggering conditions apply: (1) when the set of folders the user is permitted to read is empty, the folder restriction is dropped entirely and all alert rules in the organization are returned; and (2) from Grafana 13.1.0 onward, any user can trigger cross-folder disclosure by supplying a folder filter to the endpoint. Limiting factors: authentication is mandatory (PR:L), the disclosure is confidentiality-only, and the exposed content is limited to alert rule configuration - data source credentials are not exposed.

This is a genuine but low-severity information-disclosure issue, not a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) correctly reflects the impact: network-reachable, low attack complexity, but requiring an authenticated low-privilege account and yielding only limited confidentiality loss (C:L) with no integrity or availability impact. No EPSS score, KEV listing, or public POC was provided in the intelligence set, so there is no signal of active exploitation or automated weaponization. The exposed data is alert-rule configuration only - the advisory explicitly states data source credentials are NOT exposed - which caps the real-world harm. The one aggravating factor is that from Grafana 13.1.0 the empty-folder-set edge case was generalized so any user can trigger cross-folder disclosure via a folder filter, widening the affected population, but this still requires a valid authenticated session. Net: real but low-priority; patch on normal cadence rather than emergency.

A low-privileged authenticated Grafana user calls the alert rules API list endpoint (optionally supplying a folder filter) and receives alert rule configurations from folders they have no read permission for, including - in the empty-readable-folders case - every alert rule in the organization. No public exploit code was identified, but the technique is a trivial API call requiring no special tooling.