# CVE-2026-33379: Grafana authorization bypass in dashboard snapshots

Source: https://junglewise.ai/threats/cve-2026-33379-a-user-with-any-role-including-viewer-or-a-service-account-with  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-33379 · Severity: high · CVSS 8.5 · Published 2026-11-06

Grafana, an observability and monitoring platform, contains an authorization flaw in its dashboard snapshot feature. Users with minimal or no permissions—including Viewer-role users and service accounts—can create, publish externally, and delete dashboard snapshots that they should not be able to access. This could allow unauthorized access to sensitive monitoring data or disruption of monitoring infrastructure through snapshot manipulation.

Technologies: [Grafana Enterprise](https://junglewise.ai/threats/technologies/grafana-grafana-enterprise), [Grafana OSS](https://junglewise.ai/threats/technologies/grafana-grafana-oss). Vendors: [Grafana](https://junglewise.ai/threats/vendors/grafana).

## Quick answers

**Is CVE-2026-33379 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33379 being exploited in the wild.

**How severe is CVE-2026-33379?** High severity, with a CVSS score of 8.5, published 6 November 2026.

**Which products and versions are affected?** Grafana Enterprise 12.4; Grafana OSS 12.4.

**Is there a fix for CVE-2026-33379?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-33379 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-33379?** Check whether you run Grafana Enterprise or Grafana OSS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization check in the dashboard snapshot functionality of Grafana. Any authenticated user, regardless of role assignment (including Viewer and unprivileged service accounts), can perform snapshot operations that should be restricted to admin or privileged users. The flaw affects only Grafana OSS and Grafana Enterprise version 12.4; earlier versions and Grafana 13+ are unaffected.

## Affected products

- Grafana Grafana OSS 12.4
- Grafana Grafana Enterprise 12.4

## Timeline

- 2026-11-06: advisory

## References

- [https://grafana.com/security/security-advisories/cve-2026-33379](https://grafana.com/security/security-advisories/cve-2026-33379)

## Related threats

- [Grafana SSO settings authorization bypass](https://junglewise.ai/threats/cve-2026-103506-an-authenticated-user-in-grafana-can-read-sso-client-secrets-and)
- [Grafana SCIM API insecure direct object reference across organizations](https://junglewise.ai/threats/cve-2026-92539-a-service-account-with-user-management-permissions-in-one)
- [Grafana data source proxy authorization bypass in Loki rules API](https://junglewise.ai/threats/cve-2026-9703-grafana-s-data-source-proxy-did-not-apply-role-based-access)