Grafana’s data source proxy does not enforce role‑based access control on POST, PUT, and DELETE requests sent to the Loki rules API. Because the Loki rules are stored inside Loki rather than in Grafana, a user with only the Viewer role can create, modify, or delete alerting rules that affect every client that uses the same Loki data source. The vulnerability therefore allows an authenticated low‑privilege user to tamper with alert configurations, potentially suppressing legitimate alerts or generating false alarms, which compromises the integrity of monitoring and can lead to unnoticed incidents or deliberate sabotage.

The flaw is present in both Grafana OSS and Grafana Enterprise. Any instance configured with a Loki data source that forwards write requests through Grafana’s proxy is affected. No specific Grafana version is listed; users should check the vendor advisory for the applicable releases. Loki itself is not vulnerable and does not need to be patched.

The CVSS base score is 7.1, indicating high severity. The EPSS score is less than 1%, suggesting that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. An attacker only needs a legitimate Viewer account and a configured Loki data source; no higher privileges were required. Once exploited, changes apply at the Loki level, affecting all users of that data source across the organization.