IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
8.5Yüksek

CVE-2026-33379Dashboard snapshot permission bypass

Grafana Grafana OSS; Grafana Grafana Enterprise Yayım: (5 gün önce)

Açıklama

A user with any role, including Viewer or a service account with no permissions, can create, externally publish, and delete dashboard snapshots (missing authorization). Only Grafana OSS and Grafana Enterprise 12.4 are affected; earlier versions and Grafana 13 are not.

Zayıflık türü (CWE): CWE-862

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
Grafana Grafana Enterprise 12.4.0 – < 12.4.4
Grafana Grafana OSS 12.4.0 – < 12.4.4

Kaynaklar ve yamalar

Aynı üründe son açıklar — Grafana

8.9Yüksek
CVE-2026-103506

SSO settings authorization bypass

Grafana Grafana Enterprise; Grafana Grafana OSS

An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettings…

6.5Orta
CVE-2026-88858

Server-side expression parser denial of service

Grafana Grafana OSS; Grafana Grafana Enterprise

A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression (uncontrolled recursion). A user with permission to provision alert rules can make the outage persist across restarts.

7.7Yüksek
CVE-2026-88967

Azure Monitor access token disclosure via SSRF

Grafana Grafana Enterprise; Grafana Grafana OSS

A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).

7.7Yüksek
CVE-2026-100105

Alerting contact point authorization bypass via schema downgrade

Grafana Grafana Enterprise; Grafana Grafana OSS

A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect ale…

6.5Orta
CVE-2026-16491

CVE-2026-16491 CVE Record

Grafana Grafana Enterprise; Grafana Grafana OSS

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of ever…