CVE-2026-16491Medium· 6.5▾ SunlitGrafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder.
This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.
enterprise >= 13.0.0 <= 13.0.4enterprise >= 13.1.0 <= 13.1.1enterprise >= 13.0.0 <= 13.1.0oss >= 13.0.0 <= 13.1.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-81841Medium· 5.3Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data
CVE-2026-92539Medium· 6.7Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise
CVE-2026-9703High· 7.1Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources
CVE-2026-13719Medium· 4.3An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint
CVE-2026-81842Medium· 4.3An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource
CVE-2025-12924Medium· 4.3A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224