Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-33377

Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana Grafana OSS

Default version status: unaffected

  • 8.5.0 to ≤ 11.6.14affected
  • 11.6.14 to < 11.6.14+security-04affected
  • 12.0.0 to ≤ 12.2.8affected
  • 12.2.8 to < 12.2.8+security-04affected
  • 12.3.0 to ≤ 12.3.6affected
  • 12.3.6 to < 12.3.6+security-04affected
  • 12.4.0 to ≤ 12.4.3affected
  • 12.4.3 to < 12.4.3+security-02affected
  • 13.0.0 to ≤ 13.0.1affected
  • 13.0.1 to < 13.0.1+security-01affected

References