5.3 Medium

CVE-2026-81841 Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data

Description

Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.

Affected products and versions

Product	Affected versions	Fixed in
Grafana Enterprise 13.2	13.2.0 → < 13.2.3	13.2.3
Grafana Enterprise 13.1	13.1.0 → < 13.1.7	13.1.7
Grafana Enterprise 13.0	13.0.0 → < 13.0.10	13.0.10
Grafana Enterprise 12.4	12.4.0 → < 12.4.12	12.4.12
Grafana Enterprise 12.3	12.3.0 → 12.3.11	No fix stated
Grafana Enterprise 12.2	12.2.0 → 12.2.11	No fix stated
Grafana Enterprise 12.1	12.1.0 → 12.1.10	No fix stated
Grafana Enterprise 12.0	12.0.0 → 12.0.10	No fix stated
Grafana Enterprise 11.6	11.6.0 → 11.6.17	No fix stated

Show the 9 other branches

Product	Affected versions	Fixed in
Grafana OSS 13.2	13.2.0 → < 13.2.3	13.2.3
Grafana OSS 13.1	13.1.0 → < 13.1.7	13.1.7
Grafana OSS 13.0	13.0.0 → < 13.0.10	13.0.10
Grafana OSS 12.4	12.4.0 → < 12.4.12	12.4.12
Grafana OSS 12.3	12.3.0 → 12.3.11	No fix stated
Grafana OSS 12.2	12.2.0 → 12.2.11	No fix stated
Grafana OSS 12.1	12.1.0 → 12.1.10	No fix stated
Grafana OSS 12.0	12.0.0 → 12.0.10	No fix stated
Grafana OSS 11.6	11.6.0 → 11.6.17	No fix stated