CVE-2026-16491 CVE Record (Grafana Grafana Enterprise)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.29 % · percentile 22 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GRAFANA
- NVD status
- Awaiting Analysis
Description
Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.
Weaknesses (CWE)
- CWE-862 — Missing Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N | GRAFANA |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N | NVD · security@grafana.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-111233
- GCVE · GCVE-0-2026-16491
Affected products
| Product | Versions |
|---|---|
| Grafana · Grafana Enterprise | affected 13.0.0 ≤ 13.0.4 ; affected 13.1.0 ≤ 13.1.1 |
| Grafana · Grafana Enterprise | affected 13.0.0 ≤ 13.1.0 |
| Grafana · Grafana OSS | affected 13.0.0 ≤ 13.1.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |