8.1
High
CVE-2026-21721 The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:*…
Description
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| grafana/grafana 10.2 | 10.2.0 → < 11.6.9 | 11.6.9 |
| grafana/grafana-enterprise 12.3 | 12.3.0 → < 12.3.1 | 12.3.1 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 10) | Versions not published | |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 9) | Versions not published | |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 1774002166 | earliest → < 1774002166 | 1774002166 |
| Red Hat Advanced Cluster Management for Kubernetes 2.13 1774950654 | earliest → < 1774950654 | 1774950654 |
| Multicluster Global Hub | Versions not published |
Show the 9 other branches Hide the 9 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Ceph Storage 5 | Versions not published | |
| Red Hat Ceph Storage 6 | Versions not published | |
| Red Hat Ceph Storage 8 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 10.0 Extended Update Support | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat Enterprise Linux 9.6 Extended Update Support | Versions not published | |
| Red Hat Advanced Cluster Management for Kubernetes 2.11 1783578847 | earliest → < 1783578847 | 1783578847 |
References
- grafana.com grafana.com
Timeline
- Published
- Last modified
Other CVEs of grafana/grafana
The 4 CVEs of grafana/grafana →
CVE-2025-41117
Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the…
6.8
Medium
CVE-2026-21722
Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the…
5.3
Medium
CVE-2026-21720
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image
7.5
High