Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2026-13720

Editor can forge file-provisioning provenance on dashboards via the dashboard API

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana Grafana OSS

Default version status: unaffected

  • 12.0.0 to ≤ 12.0.10affected
  • 12.1.0 to ≤ 12.1.10affected
  • 12.2.0 to ≤ 12.2.11affected
  • 12.3.0 to ≤ 12.3.11affected
  • 12.4.0 to < 12.4.12affected
  • 13.0.0 to < 13.0.10affected
  • 13.1.0 to < 13.1.7affected
  • 13.2.0 to < 13.2.3affected

Grafana Grafana Enterprise

Default version status: unaffected

  • 12.0.0 to ≤ 12.0.10affected
  • 12.1.0 to ≤ 12.1.10affected
  • 12.2.0 to ≤ 12.2.11affected
  • 12.3.0 to ≤ 12.3.11affected
  • 12.4.0 to < 12.4.12affected
  • 13.0.0 to < 13.0.10affected
  • 13.1.0 to < 13.1.7affected
  • 13.2.0 to < 13.2.3affected

References