{"id":"CVE-2026-33379","kind":"vulnerability","aliases":["CVE-2026-33379"],"related":[],"title":"Grafana: any role can publish and delete dashboard snapshots","description":"A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not.","summary":"Grafana OSS and Grafana Enterprise 12.4 lack an authorization check on dashboard snapshots. Any signed-in user, including Viewers and service accounts with no permissions, can create, externally publish, and delete snapshots.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"grafana","fixed":[],"affected":"12.4","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","dashboards","grafana","runtime","self-hosted"],"not_affected_if":["grafana-13","pre-12.4-version"],"how_to_check":"- Run grafana server -v (or the About/Help menu) and check whether you run Grafana OSS or Enterprise 12.4.x; NVD names 12.4 as affected, earlier versions and Grafana 13 as not.\n- Check Dashboards > Snapshots for snapshots nobody on your team created, and review Viewer users and service accounts, since any account can exploit this.\n- Until Grafana publishes a fixed version, check the Grafana advisory page for CVE-2026-33379.","fix":null,"status":"open","published_at":"2026-11-06T10:16:37+00:00","first_seen_at":"2026-11-06T10:40:57+00:00","triaged_at":"2026-11-06T10:41:11+00:00","updated_at":"2026-11-06T10:42:39+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-06T10:41:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Grafana: any role can publish and delete dashboard snapshots","impact":"medium","summary":"Grafana OSS and Grafana Enterprise 12.4 lack an authorization check on dashboard snapshots. Any signed-in user, including Viewers and service accounts with no permissions, can create, externally publish, and delete snapshots.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["grafana","self-hosted","dashboards"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Any account can publish and delete dashboard snapshots, exposing dashboard data externally.","analyst_note":"Confirm the fixed Grafana 12.4 release and any setting that restricts snapshots, using the NVD entry linked in the source.","how_to_check":"- Check the Grafana version with `grafana server -v` or the About page; 12.4 is affected, earlier versions and Grafana 13 are not.\n- Review which users and service accounts exist, since any account can exploit this.","plain_action":"","needs_analyst":true,"not_affected_if":["grafana-13","pre-12.4-version"],"who_is_affected":"Teams running self-hosted or enterprise Grafana 12.4 with user accounts or service accounts that are not trusted to publish dashboard data. The sources only name Grafana OSS and Grafana Enterprise 12.4 as affected, so Grafana 13 and earlier versions are out of scope.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.0007,"input_tokens":4209,"output_tokens":559,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed Grafana 12.4 release and any setting that restricts snapshots, using the NVD entry linked in the source.","search":"'-2026':11A,14A '-33379':12A,15A '12.4':29B,87C '13':94C 'account':46B,67C 'affect':89C 'authent':17B 'author':32B,80C 'check':33B 'creat':51B,72C 'cve':10A,13A 'dashboard':8A,18B,35B,77C 'delet':7A,55B,76C 'earlier':90C 'enterpris':28B,86C 'extern':52B,73C 'grafana':1A,16A,19B,24B,27B,82C,85C,93C 'host':23B 'includ':42B,62C 'lack':30B 'miss':79C 'oss':25B,83C 'permiss':49B,70C 'publish':5A,53B,74C 'role':3A,61C 'runtim':20B 'self':22B 'self-host':21B 'servic':45B,66C 'sign':39B 'signed-in':38B 'snapshot':9A,36B,56B,78C 'user':41B,58C 'version':91C 'viewer':43B,63C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted or enterprise Grafana 12.4 with user accounts or service accounts that are not trusted to publish dashboard data. The sources only name Grafana OSS and Grafana Enterprise 12.4 as affected, so Grafana 13 and earlier versions are out of scope.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["grafana"],"ptokens":["grafana"],"labels":["authenticated","dashboards","grafana","high","runtime","selfhosted"],"campaign_type":null,"search_a":"'-2026':11A,14A '-33379':12A,15A 'cve':10A,13A 'dashboard':8A 'delet':7A 'grafana':1A,16A 'publish':5A 'role':3A 'snapshot':9A","search_b":"'12.4':29B 'account':46B 'authent':17B 'author':32B 'check':33B 'creat':51B 'dashboard':18B,35B 'delet':55B 'enterpris':28B 'extern':52B 'grafana':19B,24B,27B 'host':23B 'includ':42B 'lack':30B 'oss':25B 'permiss':49B 'publish':53B 'runtim':20B 'self':22B 'self-host':21B 'servic':45B 'sign':39B 'signed-in':38B 'snapshot':36B,56B 'user':41B 'viewer':43B","search_c":"'12.4':87C '13':94C 'account':67C 'affect':89C 'author':80C 'creat':72C 'dashboard':77C 'delet':76C 'earlier':90C 'enterpris':86C 'extern':73C 'grafana':82C,85C,93C 'includ':62C 'miss':79C 'oss':83C 'permiss':70C 'publish':74C 'role':61C 'servic':66C 'snapshot':78C 'user':58C 'version':91C 'viewer':63C","first_public_at":"2026-11-06T10:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cvss_by":"security@grafana.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-33379","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33379","severity":null,"published_at":"2026-11-06T10:16:37+00:00","modified_at":"2026-11-06T10:16:37+00:00","first_seen_at":"2026-11-06T10:40:57+00:00","fetched_at":"2026-11-06T10:40:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-33379:1881","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33379","severity":null,"published_at":"2026-11-06T10:42:39+00:00","modified_at":"2026-11-06T10:42:39+00:00","first_seen_at":"2026-11-06T10:42:39+00:00","fetched_at":"2026-11-06T10:42:39+00:00","note":"Only NVD text available (CVSS 8.5 from security@grafana.com). Grafana advisory page for this CVE not published/indexed yet; advisories index (checked 2026-11-06) does not list it. Fixed 12.4.x version and any snapshot-restricting setting NOT confirmed; fix left unknown. Nothing verified. Related but separate: CVE-2026-28380 (Editor deletes any snapshot, fixed 12.4.3+security-02) and CVE-2026-19197 (cross-org snapshot delete). Revisit when grafana.com/security/security-advisories/cve-2026-33379 appears.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-33379"]}],"documents":[{"id":85675,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33379","title":"NVD CVE-2026-33379","kind":"advisory","source":"analyst","publisher":null,"text":"A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not. CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N (source: security@grafana.com).","published_at":null,"relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}