CVE-2026-9703

{
  "etk_id": "ETK-2026-1706",
  "cve_id": "CVE-2026-9703",
  "display_id": "CVE-2026-9703",
  "ghsa_id": "GHSA-c6mh-c9x8-gf7q",
  "euvd_id": "EUVD-2026-102073",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in Grafana data source proxy",
  "summary": "Grafana OSS and Enterprise data source proxies can allow Viewer-role users to make rule-changing requests to a configured Loki data source. An authenticated Viewer can thereby alter Loki alerting rules that affect other users of that data source.",
  "mitigation": "Remove unneeded Loki data sources and restrict or suspend Viewer accounts where feasible until an update is available. Review Loki alerting rules for unauthorized changes and monitor proxy activity targeting the Loki rules endpoint.",
  "vendor": "Grafana",
  "product": "Grafana Enterprise",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 8.0.0, <= 11.5.10",
        ">= 11.6.0, <= 11.6.16",
        ">= 12.0.0, <= 12.1.10",
        ">= 12.2.0, <= 12.2.10",
        ">= 12.3.0, <= 12.3.8",
        ">= 12.4.0, <= 12.4.5",
        ">= 13.0.0, <= 13.0.3"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Grafana Enterprise",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 12.3.0, <= 12.3.8",
        ">= 12.4.0, <= 12.4.5",
        ">= 8.0.0, <= 12.3.0",
        ">= 13.0.0, <= 13.0.3"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Grafana OSS",
      "purl": null
    }
  ],
  "cwes": [
    284
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
  "epss_score": 0.002,
  "epss_percentile": 0.0861,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 53.8381532,
  "t0_at": "2026-10-15T14:02:00.146000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-15T19:20:00.880173+00:00",
      "days": 0.2208418307060185,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T14:02:00.146000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-15T14:02:00.146000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T14:02:00.146000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9703"
    }
  }
}