CVE-2026-15577: Git Sync connection configuration can be modified with read-only access
A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the experimental provisioning feature toggle to make the affected Git Sync provisioning API unavailable.
Grafana 12.4 experimental provisioning feature toggle = disabled
Event History
Frequently Asked Questions
Who can exploit this issue?
A user or service account that has read-only access to Git Sync provisioning connections can exploit it. Exploitation requires access to the affected API; on Grafana 12.4, that API is available only when the experimental provisioning feature toggle is enabled.
What is the impact of successful exploitation?
An attacker can modify a Git Sync connection's configuration through its status subresource despite having only read-only access. The provided severity vector indicates network access, low attack complexity, low privileges, no user interaction, and high integrity impact.
Are default Grafana 12.4 deployments affected?
For Grafana 12.4, the affected API is available only if the experimental provisioning feature toggle is enabled. The supplied data does not state whether that toggle is enabled by default.