Grafana Authorization Bypass Vulnerability in Datasource Proxy API

A vulnerability exists in Grafana's datasource proxy API that allows users with minimal permissions to bypass authorization checks. By adding an extra slash in the URL path, these users could gain unauthorized read access to GET endpoints in Alertmanager and certain Prometheus-based datasources. This issue mainly affects datasources with route-specific permissions.

Impact

Exploitation of this vulnerability could lead to unauthorized read access on GET endpoints in Alertmanager and Prometheus datasources, allowing users with minimal permissions to access restricted information.

Remediation

Users can upgrade to Grafana versions v10.4.17+security-01, v11.2.8+security-01, v11.3.5+security-01, v11.4.3+security-01, v11.5.3+security-01, v11.6.0+security-01 or above to address this vulnerability.