Grafana dashboard snapshots missing authorization checks

Anyone with a Grafana dashboard account can change shared dashboards.

Summary

Any user, including Viewer or service accounts with no permissions, can create, publicly publish, and delete dashboard snapshots. Grafana OSS and Grafana Enterprise 12.4 are affected.

Affected when

Grafana OSS or Grafana Enterprise 12.4

What to do

Update to Grafana 12.4.4 or later.

Products and platforms

Grafana Enterprise
Grafana OSS

CVE IDs

CVE-2026-33379 (opens in a new tab)

Sources

Advisory: grafana.com (opens in a new tab)

Times

First published 2026-11-06 10:05 UTC

First seen 2026-11-09 17:40 UTC