Wrong Permission in Grafana's Alert Rule Write API Endpoint Allows Unauthorized Rule Writing

CVE-2024-8118

Summary

A vulnerability exists in Grafana where incorrect permission settings on the alert rule write API endpoint provide users with write access to external alert instances, inadvertently allowing them to modify alert rules. This misconfiguration can lead to unintentional alterations of important alert settings, posing potential security risks for organizations that rely on Grafana for monitoring and alerting. It is crucial for users running affected versions to update their installations to mitigate this risk and maintain the integrity of their alerting systems.

References