CVE-2026-21721High· 8.1▾ MidnightPoC availableThe dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on ot…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 44.6 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
1 GitHub repo
0.6% → 0.7%
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
grafana >= 10.2.0, < 11.6.9grafana >= 12.0.0, < 12.0.8grafana >= 12.1.0, < 12.1.5grafana >= 12.2.0, < 12.2.3grafana = 11.6.9grafana = 12.0.8grafana = 12.1.5grafana = 12.2.3grafana = 12.3.0grafana = 12.3.1Upgrade past the affected range:
grafana 12.2.3Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-14199High· 7.1Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected
CVE-2026-11817Medium· 5.3CVE-2026-11817 CVE Record
CVE-2026-15630Critical· 9.9A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).
CVE-2026-47227Medium· 6.5Admidio is an open-source user management solution
CVE-2026-21727Low· 3.3A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records
CVE-2021-46416High· 8.1Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.