{"id":"CVE-2026-33381","published":"2026-05-13T19:28:31Z","modified":"2026-08-27T17:22:46Z","title":"Users can generate Service Account tokens after permissions removal","vendor":"Grafana","product":"Grafana OSS","tier":"tail","description":{"text":"When a user's access to mint tokens for a service account is revoked, it is sometimes still possible to do so for a few seconds after the event. The user will eventually lose access to do this.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.9,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00343,"percentile":0.27732,"provenance":"source"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-33381","tags":["vendor-advisory"]}],"priority":{"score":9.7,"factors":[{"name":"EPSS percentile","points":5.55},{"name":"CVSS severity","points":4.13}]},"vendorSlug":"grafana","affectedVersions":[{"vendor":"Grafana","product":"Grafana OSS","versions":[">= 9.2.0, <= 11.6.14",">= 11.6.14, < 11.6.14+security-04",">= 12.0.0, <= 12.2.8",">= 12.2.8, < 12.2.8+security-04",">= 12.3.0, <= 12.3.6",">= 12.3.6, < 12.3.6+security-04",">= 12.4.0, <= 12.4.3",">= 12.4.3, < 12.4.3+security-02",">= 13.0.0, <= 13.0.1",">= 13.0.1, < 13.0.1+security-01"]}],"affected":[{"ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":["<1.9.2-0.20260513165311-fb7336fc36c1","all versions"],"patched":["1.9.2-0.20260513165311-fb7336fc36c1"],"from":["GHSA-wfhv-mj62-f5xh","GO-2026-5708"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-30146","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2026-21727","published":"2026-04-15","fixed":"1.9.2-0.20260127141016-e702db6096e0","kev":false},{"cve":"CVE-2026-21724","published":"2026-03-26","fixed":"1.9.2-0.20260323180334-daffe750de85","kev":false},{"cve":"CVE-2026-33380","published":"2026-05-13","fixed":"1.9.2-0.20260513165311-fb7336fc36c1","kev":false},{"cve":"CVE-2026-33381","published":"2026-05-13","fixed":"1.9.2-0.20260513165311-fb7336fc36c1","kev":false},{"cve":"CVE-2018-12099","published":"2018-06-11","fixed":"5.2.0-beta1+incompatible","kev":false},{"cve":"CVE-2018-15727","published":"2018-08-29","fixed":"5.2.3+incompatible","kev":false},{"cve":"CVE-2018-1000816","published":"2018-12-20","fixed":"5.3.2","kev":false},{"cve":"CVE-2026-27877","published":"2026-03-27","fixed":"12.4.2","kev":false,"link":{"from":"CVE-2026-27877","to":"CVE-2026-33381","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"1.9.2-0.20260325055210-3522153e07b4","toFixed":"1.9.2-0.20260513165311-fb7336fc36c1","daysApart":47}]}}],"package":"Go:github.com/grafana/grafana"}}