Skip to content
fr Sign in
5.4 Medium

CVE-2026-13720 An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and…

Description

An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.

Affected products and versions

Product Affected versions Fixed in
Grafana OSS 13.2 13.2.0 → < 13.2.3 13.2.3
Grafana OSS 13.1 13.1.0 → < 13.1.7 13.1.7
Grafana OSS 13.0 13.0.0 → < 13.0.10 13.0.10
Grafana OSS 12.4 12.4.0 → < 12.4.12 12.4.12
Grafana OSS 12.3 12.3.0 → 12.3.11 No fix stated
Grafana OSS 12.2 12.2.0 → 12.2.11 No fix stated
Grafana OSS 12.1 12.1.0 → 12.1.10 No fix stated
Grafana OSS 12.0 12.0.0 → 12.0.10 No fix stated
Grafana Enterprise 13.2 13.2.0 → < 13.2.3 13.2.3
Show the 7 other branches
Product Affected versions Fixed in
Grafana Enterprise 13.1 13.1.0 → < 13.1.7 13.1.7
Grafana Enterprise 13.0 13.0.0 → < 13.0.10 13.0.10
Grafana Enterprise 12.4 12.4.0 → < 12.4.12 12.4.12
Grafana Enterprise 12.3 12.3.0 → 12.3.11 No fix stated
Grafana Enterprise 12.2 12.2.0 → 12.2.11 No fix stated
Grafana Enterprise 12.1 12.1.0 → 12.1.10 No fix stated
Grafana Enterprise 12.0 12.0.0 → 12.0.10 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Grafana OSS

The 44 CVEs of Grafana OSS →
CVE-2026-79656 OAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors 6.0 Medium CVE-2026-103506 SSO settings authorization bypass 8.9 High CVE-2026-88858 Server-side expression parser denial of service 6.5 Medium CVE-2026-88967 Azure Monitor access token disclosure via SSRF 7.7 High
Track this CVE