IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
6.5Mittel

CVE-2026-16491CVE-2026-16491 CVE Record

Grafana Grafana Enterprise; Grafana Grafana OSS Veröffentlicht: (vor 14 Tagen)

Beschreibung

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.

Schwachstellentyp (CWE): CWE-862

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
Grafana Grafana Enterprise 13.0.0 – ≤ 13.0.4, 13.1.0 – ≤ 13.1.1
Grafana Grafana OSS 13.0.0 – ≤ 13.1.1

Referenzen und Patches

Neue CVEs im selben Produkt — Grafana

8.5Hoch
CVE-2026-33379

Dashboard snapshot permission bypass

Grafana Grafana OSS; Grafana Grafana Enterprise

A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13…

8.9Hoch
CVE-2026-103506

SSO settings authorization bypass

Grafana Grafana Enterprise; Grafana Grafana OSS

An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettings…

6.5Mittel
CVE-2026-88858

Server-side expression parser denial of service

Grafana Grafana OSS; Grafana Grafana Enterprise

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.

7.7Hoch
CVE-2026-88967

Azure Monitor access token disclosure via SSRF

Grafana Grafana Enterprise; Grafana Grafana OSS

A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).

7.7Hoch
CVE-2026-100105

Alerting contact point authorization bypass via schema downgrade

Grafana Grafana Enterprise; Grafana Grafana OSS

A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect ale…