A user or service account that has been granted read‑only access to Git Sync provisioning connections can modify a connection’s configuration through its status subresource, due to an incorrect authorization check. This allows an attacker to change the list of repositories, modify authentication details, or alter connection parameters, effectively enabling unauthorized access to code repositories or manipulating the provisioning process. The outcome is a loss of integrity of the configuration data and potential exposure of sensitive code or infrastructure changes.

This issue affects Grafana Enterprise and Grafana OSS, specifically version 12.4 where the experimental provisioning feature toggle is enabled. The vulnerable API is only available when this toggle is turned on, making the target scope limited to deployments that have chosen to enable experimental provisioning.

The CVSS score of 6.5 indicates a medium severity. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA KEV, suggesting that large‑scale exploitation is not yet documented. An attacker would need to send a request to the status subresource of a provisioning connection while possessing read‑only access; the presence of the experimental toggle is a prerequisite. Once accessed, the attacker can rewrite configuration parameters, equivalent to an authorization bypass (CWE‑863). The likelihood of exploitation is uncertain but not negligible in environments that rely on experimental provisioning and maintain read‑only accounts with provisioning rights.