6.5 Medium

CVE-2026-16491 CVE-2026-16491 CVE Record

Description

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Exploitable remotely over the network, with an administrator account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: High
Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

Affected products and versions

Product	Affected versions	Fixed in
Grafana Enterprise 13.0	13.0.0 → 13.1.0	No fix stated
Grafana OSS 13.0	13.0.0 → 13.1.1	No fix stated

References

grafana.com grafana.com

Timeline

Published October 27, 2026
Last modified November 4, 2026

The 41 CVEs of Grafana Enterprise →

CVE-2026-33379 Dashboard snapshot permission bypass 8.5 High CVE-2026-79656 OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors 6.0 Medium CVE-2026-103506 SSO settings authorization bypass 8.9 High CVE-2026-88858 Server-side expression parser denial of service 6.5 Medium

Track this CVE