---
id: CVE-2026-103506
title: SSO settings authorization bypass
summary: >-
  An authenticated user in Grafana can read SSO client secrets and modify
  instance-wide SSO settings without the required permissions (missing
  authorization). This affects Grafana OSS and Enterprise 13.2 installations
  with the experimental…
severity: high
cvss: 8.9
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L'
cvssSource: cna
cwe:
  - CWE-285
vendor: Grafana
product: Grafana Enterprise
affected:
  - enterprise >= 13.2.0 <= 13.2.4
  - oss >= 13.2.0 <= 13.2.4
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T16:50:30.111Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-103506'
references:
  - url: 'https://grafana.com/security/security-advisories/cve-2026-103506'
tags:
  - cve.org
ingestedAt: '2026-10-28T17:14:44.434Z'
---

## Overview

An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsApi feature toggle enabled, which is disabled by default.

## Affected

- `enterprise >= 13.2.0 <= 13.2.4`
- `oss >= 13.2.0 <= 13.2.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.