A flaw was found in Grafana's Elasticsearch data source. An authenticated user with permission to query the data source, such as a viewer, can send arbitrary requests to the connected Elasticsearch cluster using the data source's stored credentials. This allows an attacker to bypass intended restrictions, access data across unauthorized indices, and execute write operations to modify index configurations or data.