Description

A flaw was found in Grafana. An authenticated user can query the alert rules list Application Programming Interface (API) to access alert rules stored in restricted folders they lack permission to read. When access restrictions are evaluated and a user has no readable folders, folder filtering is dropped and all alert rules within the organization are returned. This flaw results in unauthorized information disclosure of alert rule configurations, though data source credentials are not exposed.

Mitigation

Aliases