A missing authorization check in Grafana allows any authenticated user, including viewers and service accounts with no permissions, to create, externally publish, and delete dashboard snapshots. The flaw permits an attacker to expose sensitive dashboard data to the public or remove valuable audit artifacts, undermining confidentiality, integrity, and availability of monitoring information. The weakness is a classic example of CWE‑862: Missing Authorization.

Grafana OSS and Grafana Enterprise 12.4 are vulnerable. Versions older than 12.4 and Grafana 13 and newer are not affected by this flaw.

The CVSS score of 8.5 indicates high severity, and the episode score is not available while the vulnerability is not listed in KEV. Likely, an attacker can exploit the flaw by issuing API requests to the snapshot endpoints via the web interface or directly. Because any role can perform the actions, the risk of unauthorized data exposure or disruption is significant, especially in large deployments where snapshots may contain proprietary or sensitive data.