Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2026-76154

CVE-2026-76154 CVE Record

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana Grafana OSS

Default version status: unaffected

  • 12.3.0affected
  • 12.4.0 to ≤ 12.4.10affected
  • 13.0.0 to ≤ 13.0.8affected
  • 13.1.0 to ≤ 13.1.5affected
  • 13.2.0 to ≤ 13.2.1affected

Grafana Grafana Enterprise

Default version status: unaffected

  • 12.3.0affected
  • 12.4.0 to ≤ 12.4.10affected
  • 13.0.0 to ≤ 13.0.8affected
  • 13.1.0 to ≤ 13.1.5affected
  • 13.2.0 to ≤ 13.2.1affected

References