Advisoriesby IbisGrafana LabsCVE-2026-16491
Grafana: missing authorization
No fix yet
Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder.
This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Grafana Enterprise Product | >= 13.0.0, <= 13.0.4 | No fix yet |
| >= 13.1.0, <= 13.1.1 | No fix yet | |
| >= 13.0.0, <= 13.1.0 | No fix yet | |
| Grafana OSS Product | >= 13.0.0, <= 13.1.1 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-862