Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-19197

Broken access control in dashboard snapshots

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana Grafana OSS

Default version status: unaffected

  • 12.4.0 to < 12.4.8affected
  • 13.0.0 to < 13.0.6affected
  • 13.1.0 to < 13.1.3affected

Grafana Grafana Enterprise

Default version status: unaffected

  • 12.4.0 to < 12.4.8affected
  • 13.0.0 to < 13.0.6affected
  • 13.1.0 to < 13.1.3affected

References