The vulnerability allows a user with Org Admin rights in one organization to invoke the endpoint /api/access-control/users/permissions/search with actionPrefix=dashboards:. The API returns the UID of dashboards and folders, and the mapping of which users possess which permissions on those dashboards in other organizations. This reveals cross‑organization permission ownership and scope but does not expose dashboard contents, query results, datasource credentials, or personal data. The weakness is an incomplete information (CWE‑863).

Grafana Enterprise and Grafana Open‑Source Stack deployments that enable multi‑organization mode. Any deployment that allows more than one organization is potentially affected; version information is not provided in the advisory.

The advisory lists a CVSS score of 5.3, indicating medium severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread publicly known exploits. Exploitation requires that the attacker already holds Org Admin privileges in at least one organization, and the attack vector is intra‑application. Consequently, the risk hinges on the protection of Org Admin accounts and the prevalence of multi‑organization configurations.