Pausing a shared dashboard leaves its access token active for the frontend bootstrap endpoint, allowing anyone with the shared link to retrieve the dashboard’s data source configuration, including stored credentials, without authentication. This missing authorization flaw (CWE‑862) and the resulting information exposure (CWE‑613) enable a confidentiality breach that could expose database passwords or API keys and lead to further exploitation.

The issue affects Grafana Enterprise and Grafana OSS platforms that use shared dashboards, so all installations that enable dashboard sharing without an updated fix are at risk.

With a CVSS score of 5.3 the vulnerability is moderate in severity. The EPSS score indicates less than 1% exploitation probability, and the scenario is not in the CISA KEV catalog. An attacker only needs to know the paused dashboard URL; the likely attack vector is an unauthenticated HTTP GET to the bootstrap endpoint that serves the dashboard configuration. Once an attacker obtains the data source details, further attacks can be carried out if sensitive credentials are exposed.