Vulnerability · Published Oct 27, 2026 · Assigned by GRAFANA

CVE-2026-16491CVE-2026-16491 CVE Record

Medium 6.5

In plain English

A medium-severity missing authorization in Grafana Enterprise from Grafana. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 78.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.

Affected products (as reported)

Vendor	Product	Versions
Grafana	Grafana Enterprise	13.0.0 – through 13.0.413.1.0 – through 13.1.1
Grafana	Grafana Enterprise	13.0.0 – through 13.1.0
Grafana	Grafana OSS	13.0.0 – through 13.1.1

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

References

https://grafana.com/security/security-advisories/cve-2026-16491 vendor-advisory