5.4 Medium

CVE-2026-13720 An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and…

Description

An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.

Affected products and versions

Product	Affected versions	Fixed in
Grafana OSS 13.2	13.2.0 → < 13.2.3	13.2.3
Grafana OSS 13.1	13.1.0 → < 13.1.7	13.1.7
Grafana OSS 13.0	13.0.0 → < 13.0.10	13.0.10
Grafana OSS 12.4	12.4.0 → < 12.4.12	12.4.12
Grafana OSS 12.3	12.3.0 → 12.3.11	No fix stated
Grafana OSS 12.2	12.2.0 → 12.2.11	No fix stated
Grafana OSS 12.1	12.1.0 → 12.1.10	No fix stated
Grafana OSS 12.0	12.0.0 → 12.0.10	No fix stated
Grafana Enterprise 13.2	13.2.0 → < 13.2.3	13.2.3

Show the 7 other branches

Product	Affected versions	Fixed in
Grafana Enterprise 13.1	13.1.0 → < 13.1.7	13.1.7
Grafana Enterprise 13.0	13.0.0 → < 13.0.10	13.0.10
Grafana Enterprise 12.4	12.4.0 → < 12.4.12	12.4.12
Grafana Enterprise 12.3	12.3.0 → 12.3.11	No fix stated
Grafana Enterprise 12.2	12.2.0 → 12.2.11	No fix stated
Grafana Enterprise 12.1	12.1.0 → 12.1.10	No fix stated
Grafana Enterprise 12.0	12.0.0 → 12.0.10	No fix stated