Access control / RBAC enforcement
Description
RBAC enforcement gap for serviceaccount operations in Grafana's unified storage layer. The commit adds 'serviceaccounts' to the iam.grafana.app allowlist in the RBAC-enabled access path, ensuring that serviceaccount search/list/read operations are subject to proper RBAC checks. This prevents unauthorized users from enumerating or accessing service account metadata. The change is a security fix addressing insufficient access control rather than a mere cleanup or dependency bump.
Proof of Concept
Practical PoC (illustrative):
Assumptions:
- Grafana 12.x with unified storage RBAC enforcement path as touched by commit 8891796ca1086cd234e1715ea71d8db0073cc160.
- You have two authenticated users: an admin (RBAC-complete) and a limited-user with no explicit rights to serviceaccounts.
- The API endpoint for service account discovery is under the IAM namespace, e.g. /api/iam/serviceaccounts.
Pre-fix (vulnerable behavior):
1) Obtain a token for the limited-user.
2) As the limited-user, list service accounts:
curl -s -H "Authorization: Bearer $LIMIT_TOKEN" https://grafana.example/api/iam/serviceaccounts?limit=100
3) Expected (vulnerable) result: HTTP 200 with a full list of service accounts and their metadata, enabling enumeration by a user without proper RBAC authorization.
Post-fix (patched behavior):
1) Use the same limited-user token.
2) List service accounts again:
curl -s -H "Authorization: Bearer $LIMIT_TOKEN" https://grafana.example/api/iam/serviceaccounts?limit=100
3) Expected result: HTTP 403 Forbidden or HTTP 200 with a heavily restricted or filtered result set, reflecting that RBAC checks are now enforced for serviceaccount access.
Notes:
- Endpoint path and response structure depend on Grafana version; adapt the URL accordingly (e.g., /api/iam/serviceaccounts).
- The PoC demonstrates the access-control vector and the difference between pre- and post-patch behavior.
Commit Details
Author: Gabriel MABILLE
Date: 2026-07-03 09:14 UTC
Message:
Unified storage: Enforce RBAC for serviceaccount search/list/read (#127839)
Triage Assessment
Vulnerability Type: Access control / Privilege enforcement
Confidence: HIGH
Reasoning:
Commit message states enforcing RBAC for serviceaccount search/list/read. The code change adds 'serviceaccounts' to the allowed resources for iam.grafana.app in the RBAC allowlist, indicating a security-related adjustment to access control to prevent unauthorized access to service accounts.
Verification Assessment
Vulnerability Type: Access control / RBAC enforcement
Confidence: HIGH
Affected Versions: 12.4.0 and earlier (pre-change); fixed in later releases containing this commit
Code Diff
diff --git a/pkg/storage/unified/resource/access.go b/pkg/storage/unified/resource/access.go
index 38d4f392b31d..1663e8f88ab1 100644
--- a/pkg/storage/unified/resource/access.go
+++ b/pkg/storage/unified/resource/access.go
@@ -104,7 +104,7 @@ func NewAuthzLimitedClient(client claims.AccessClient, opts AuthzOptions) claims
allowlist: groupResource{
"dashboard.grafana.app": map[string]interface{}{"dashboards": nil},
"folder.grafana.app": map[string]interface{}{"folders": nil},
- "iam.grafana.app": map[string]interface{}{"users": nil, "teams": nil},
+ "iam.grafana.app": map[string]interface{}{"users": nil, "teams": nil, "serviceaccounts": nil},
},
logger: logger,
metrics: newMetrics(opts.Registry),