An authenticated Grafana user can enumerate alert rules in folders they are not authorized to read by using the alert rules list API endpoint. When the request specifies no folder filter or the user has no folder access, the system removes the read restriction and returns every alert rule in the organization. The disclosed data consists of rule configuration, but it does not expose underlying data source credentials.

Grafana Enterprise and Grafana OSS are affected. Any Grafana installation running version 13.1.0 or later is vulnerable when the API is accessed by a user that can trigger the folder filter behavior. No specific product versions are listed beyond the base version requirement.

The CVSS score of 4.3 indicates a low severity information‑disclosure vulnerability. No EPSS data is available, and the vulnerability is not marked as a known exploited vulnerability in CISA KEV. The attack requires an authenticated user with at least read authority on the API, and the vector is the application’s REST API over network. While the exploitation probability is not quantified, an attacker could gain insights into alert rule logic and potentially use that knowledge to plan further attacks, especially if rule configurations expose sensitive operational details. The lack of credential leakage limits the immediate impact, but the exposure of configuration data could aid in reconnaissance or phishing campaigns.