Czarflix

**Name of the Vulnerable Software and Affected Versions** Grafana OSS version 13.0.1 **Description** An authenticated low-privileged user with permissions to create or edit alert rules in a folder can bypass datasource permission enforcement. By setting the client-controlled `queryType` variable to ` expr ` while providing the UID of a real datasource, the attacker can execute queries against a datasource for which they lack `datasources:query` permissions. This occurs because the authorization path treats the query as a server-side expression and skips permission checks, but the evaluator subsequently executes the query using the real datasource identified by `datasourceUid` and Grafana's configured credentials. This can lead to unauthorized data exposure and potential state-changing queries depending on the datasource backend. **Recommendations** For Grafana OSS version 13.0.1: - Do not exempt queries from datasource authorization based solely on the client-controlled `queryType` variable. - Resolve the referenced datasource server-side before authorization and apply `datasources:query` permissions whenever the resolved UID represents a real datasource. - Require expression queries to reference only the canonical server-side expression datasource and reject mismatches where `queryType` is ` expr ` but is paired with a real datasource UID. - Ensure authorization and evaluation use the same canonical datasource identity and fail closed when fields conflict.