{"id":"CVE-2026-11817","title":"CVE-2026-11817 CVE Record","summary":"This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-863"],"vendor":"Grafana","product":"Grafana OSS","affected":["oss >= 12.4.0 <= 12.4.5","oss >= 11.2.0 <= 11.6.16","oss >= 13.0.0 <= 13.0.3","oss >= 13.1.0 <= 13.1.0","oss >= 12.2.0 <= 12.2.10","oss >= 12.3.0 <= 12.3.8","enterprise >= 13.0.0 <= 13.0.3","enterprise >= 12.2.0 <= 12.2.10","enterprise >= 11.2.0 <= 11.6.16","enterprise >= 12.3.0 <= 12.3.8","enterprise >= 12.4.0 <= 12.4.5","enterprise >= 13.1.0 <= 13.1.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-08-18T15:22:39.226844Z"},"published":"2026-08-17","updated":"2026-09-14","sourceUpdated":"2026-09-14T10:16:35.588Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-11817","references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-11817"}],"tags":["cve.org"],"epss":0.00351,"epssPercentile":0.26035,"ingestedAt":"2026-09-14T15:23:07.464Z","slug":"CVE-2026-11817","body":"## Overview\n\nThis vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only.\n\n## Affected\n\n- `oss >= 12.4.0 <= 12.4.5`\n- `oss >= 11.2.0 <= 11.6.16`\n- `oss >= 13.0.0 <= 13.0.3`\n- `oss >= 13.1.0 <= 13.1.0`\n- `oss >= 12.2.0 <= 12.2.10`\n- `oss >= 12.3.0 <= 12.3.8`\n- `enterprise >= 13.0.0 <= 13.0.3`\n- `enterprise >= 12.2.0 <= 12.2.10`\n- `enterprise >= 11.2.0 <= 11.6.16`\n- `enterprise >= 12.3.0 <= 12.3.8`\n- `enterprise >= 12.4.0 <= 12.4.5`\n- `enterprise >= 13.1.0 <= 13.1.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}