Vulnerability · Published Aug 17, 2026 · Assigned by GRAFANA
CVE-2026-11817CVE-2026-11817 CVE Record
Medium 5.3
In plain English
A medium-severity incorrect authorization in Grafana Enterprise from Grafana. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Official description
This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Grafana | Grafana OSS | 12.4.0 – through 12.4.511.2.0 – through 11.6.1613.0.0 – through 13.0.313.1.0 – through 13.1.012.2.0 – through 12.2.1012.3.0 – through 12.3.8 |
| Grafana | Grafana Enterprise | 13.0.0 – through 13.0.312.2.0 – through 12.2.1011.2.0 – through 11.6.1612.3.0 – through 12.3.812.4.0 – through 12.4.513.1.0 – through 13.1.0 |
Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://grafana.com/security/security-advisories/cve-2026-11817 vendor-advisory