IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
6.5Media

CVE-2026-16491CVE-2026-16491 CVE Record

Grafana Grafana Enterprise; Grafana Grafana OSS Publicada: (hace 14 días)

Descripción

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.

Debilidad (CWE): CWE-862

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
Grafana Grafana Enterprise 13.0.0 – ≤ 13.0.4, 13.1.0 – ≤ 13.1.1
Grafana Grafana OSS 13.0.0 – ≤ 13.1.1

Referencias y parches

CVE recientes del mismo producto — Grafana

8.5Alta
CVE-2026-33379

Dashboard snapshot permission bypass

Grafana Grafana OSS; Grafana Grafana Enterprise

A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13…

8.9Alta
CVE-2026-103506

SSO settings authorization bypass

Grafana Grafana Enterprise; Grafana Grafana OSS

An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettings…

6.5Media
CVE-2026-88858

Server-side expression parser denial of service

Grafana Grafana OSS; Grafana Grafana Enterprise

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.

7.7Alta
CVE-2026-88967

Azure Monitor access token disclosure via SSRF

Grafana Grafana Enterprise; Grafana Grafana OSS

A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).

7.7Alta
CVE-2026-100105

Alerting contact point authorization bypass via schema downgrade

Grafana Grafana Enterprise; Grafana Grafana OSS

A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect ale…