Vulnerability · Published Sep 30, 2026 · Assigned by GRAFANA
CVE-2026-13719Alert rules in restricted folders disclosed via the alert rules list API
Medium 4.3
In plain English
A medium-severity incorrect authorization in Grafana Enterprise from Grafana. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | grafana | 12.4.14-r0 | ALPINE-CVE-2026-13719 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Grafana | Grafana Enterprise | 12.3.0 – through 12.3.1112.4.0 – before 12.4.1213.0.0 – before 13.0.1013.1.0 – before 13.1.713.2.0 – before 13.2.3 |
| Grafana | Grafana OSS | 12.3.0 – through 12.3.1112.4.0 – before 12.4.1213.0.0 – before 13.0.1013.1.0 – before 13.1.713.2.0 – before 13.2.3 |
Weakness: CWE-863, CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- https://grafana.com/security/security-advisories/cve-2026-13719 vendor-advisory