An Editor user can replace a dashboard owned by another user and thereby gain administrator rights for that dashboard. The vulnerability stems from an authorization flaw that allows a user with write access to a dashboard to override its Access Control List, yielding unintended admin privileges. The weakness is a missing authorization control, corresponding to CWE-284, and involves an improper authentication flaw identified as CWE-287.

The affected product is Grafana OSS, with vulnerable versions 11.6.14, 12.2.8, 12.3.6, 12.4.3, 13.0.0 and 13.0.1. These versions lack the ACL check that prevents editors from overriding ACLs on dashboards they do not own, while newer releases contain the fix.

The CVSS score of 7.1 indicates a high security impact. The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an authenticated Editor with write rights; no external exploitation path is described. An attacker needs only the normal Editor role to overwrite the ACL and achieve dashboard‑level administrative control.