{"id":"CVE-2026-33379","published":"2026-11-06T10:16:37.943","lastModified":"2026-11-10T18:17:37.150","description":"A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not.","cvssScore":8.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-33379","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A missing authorization check in Grafana OSS and Enterprise 12.4 allows any authenticated user—including Viewers or service accounts with no permissions—to create, externally publish, and delete dashboard snapshots, potentially exposing sensitive data or disrupting monitoring visibility.","exploitability":"Exploitation requires only valid authentication (any role) and no special conditions; it is trivially exploitable via standard API endpoints.","blast_radius":"An attacker could publicly expose internal dashboard snapshots containing sensitive metrics, credentials, or infrastructure details, or delete critical snapshots to erase forensic evidence or disrupt incident response.","remediation":"Upgrade to Grafana OSS or Enterprise 12.4.1 or later, as this version includes the fix for CVE-2026-33379.","detection":"Monitor for API calls to /api/snapshots with POST (create), POST /external (publish), and DELETE methods from users assigned only Viewer roles or service accounts with minimal permissions; look for snapshot creation/deletion events in grafana.log where the user lacks SnapshotCreate, SnapshotExternalSave, or SnapshotDelete permissions.","tags":["auth-bypass","snapshot-exposure","grafana","cwe-862","high-severity"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:57:21.849Z"}}