GitHub Advisoryadvisory · Go

GHSA-wfhv-mj62-f5xh Grafana: Users can generate Service Account tokens after permissions removal

MEDIUM Published 2026-05-13 Modified 2026-06-18 Official page ↗
Aliases
CVE-2026-33381
Ecosystem
Go
Packages
github.com/grafana/grafana
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-284
Reviewed
2026-06-18

Affected packages

• Go github.com/grafana/grafana: < 1.9.2-0.20260513165311-fb7336fc36c1 → fixed in 1.9.2-0.20260513165311-fb7336fc36c1

Description

When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.

Related

Alias · CVE (1)

  • CVE-2026-33381 When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References