Grafana Dashboard Permissions API Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the Grafana Dashboard Permissions API. The issue arises because the API does not properly verify the scope of the target dashboard, only checking for the 'dashboards.permissions:*' action. This flaw allows a user with permission management rights on one dashboard to read and modify permissions on other dashboards within the same organization.

Impact

Exploitation of this vulnerability could lead to unauthorized modification of dashboard permissions, allowing users to gain elevated privileges on dashboards they should not have access to.