Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2026-21721

Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana grafana/grafana

Default version status: unaffected

  • 12.3.0 to < 12.3.1affected

Grafana grafana/grafana

Default version status: unaffected

  • 12.2.0 to < 12.2.3affected

Grafana grafana/grafana

Default version status: unaffected

  • 12.1.0 to < 12.1.5affected

Grafana grafana/grafana

Default version status: unaffected

  • 12.0.0 to < 12.0.8affected

Grafana grafana/grafana

Default version status: unaffected

  • 10.2.0 to < 11.6.9affected

Grafana grafana/grafana-enterprise

Default version status: unaffected

  • 10.2.0 to < 11.6.9affected

Grafana grafana/grafana-enterprise

Default version status: unaffected

  • 12.0.0 to < 12.0.8affected

Grafana grafana/grafana-enterprise

Default version status: unaffected

  • 12.1.0 to < 12.1.5affected

Grafana grafana/grafana-enterprise

Default version status: unaffected

  • 12.2.0 to < 12.2.3affected

Grafana grafana/grafana-enterprise

Default version status: unaffected

  • 12.3.0 to < 12.3.1affected

References