5.3
Moyenne
CVE-2026-21722 Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the…
Description
Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange. This did not leak any annotations that would not otherwise be visible on the public dashboard.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| grafana/grafana 12.3 | 12.3.0 → < 12.3.2+security-01 | 12.3.2+security-01 |
| grafana/grafana 12.2 | 12.2.0 → < 12.2.4+security-01 | 12.2.4+security-01 |
| grafana/grafana 12.0 | 12.0.0 → < 12.1.6+security-01 | 12.1.6+security-01 |
| grafana/grafana 9.3 | 9.3.0 → < 11.6.10+security-01 | 11.6.10+security-01 |
| grafana/grafana-enterprise 12.3 | 12.3.0 → < 12.3.2+security-01 | 12.3.2+security-01 |
| grafana/grafana-enterprise 12.2 | 12.2.0 → < 12.2.4+security-01 | 12.2.4+security-01 |
| grafana/grafana-enterprise 12.0 | 12.0.0 → < 12.1.6+security-01 | 12.1.6+security-01 |
| grafana/grafana-enterprise 9.3 | 9.3.0 → < 11.6.10+security-01 | 11.6.10+security-01 |
Références
- grafana.com grafana.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de grafana/grafana
Les 4 CVE de grafana/grafana →
CVE-2025-41117
Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the…
6.8
Moyenne
CVE-2026-21721
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:*…
8.1
Élevée
CVE-2026-21720
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image
7.5
Élevée