Grafana EUVD-2026-98904

Exploitation requires all of the following: (1) a valid authenticated Grafana account - a user or service account - that already has read-only access to Git Sync (provisioning) connections; (2) the instance running Grafana 12.4; and (3) the experimental 'provisioning' feature toggle explicitly enabled, since the vulnerable status subresource API does not exist otherwise. The attack is performed over the network against the connection's status subresource. Limiting factors that reduce real-world exposure: it is gated behind a non-default experimental feature toggle, requires pre-existing authenticated (low-privilege) access rather than being anonymous, and affects integrity only (configuration modification) with no data disclosure or service disruption.

This is a medium-severity authorization flaw (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) whose real-world priority is constrained by several factors. The CVSS vector confirms network-reachable, low-complexity exploitation but requires authentication (PR:L) - specifically an account that already holds read-only access to Git Sync connections - and yields integrity-only impact (I:H) with no confidentiality (C:N) or availability (A:N) effect. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Critically, the vendor description narrows applicability sharply: the affected API exists only on Grafana 12.4 and only when the experimental 'provisioning' feature toggle is enabled, meaning the vast majority of Grafana deployments are not exposed at all. The signals are internally consistent (authenticated, low-privilege, integrity-focused, scope-unchanged), so this is a legitimate but bounded issue - a privilege-boundary violation worth patching promptly where the experimental toggle is enabled, rather than an emergency for the general Grafana population. Note the input Tag 'Authentication Bypass' conflicts with CWE-863 (Incorrect Authorization): this is a privilege/authorization escalation, not an authentication bypass - exploitation still requires a valid authenticated account.

An attacker who holds (or phishes/obtains) a Grafana account with only read-only access to Git Sync provisioning connections sends a crafted request to the connection's status subresource API. Because authorization is enforced incorrectly, the request is accepted and the attacker alters the provisioning connection's configuration despite lacking write permission. No public exploit code was identified at time of analysis, and the attack only works on Grafana 12.4 instances with the experimental provisioning feature toggle enabled.