CVE-2026-16491 CVE Record
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Grafana, the open-source analytics and dashboard platform, is affected by this vulnerability. An attacker with dashboard permission-management rights on any one folder could view deleted dashboard items from other folders where they lack administrative access.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- Grafana Grafana Enterprise
From 13.0.0 · through 13.0.4; From 13.1.0 · through 13.1.1
- Grafana Grafana Enterprise
From 13.0.0 · through 13.1.0
- Grafana Grafana OSS
From 13.0.0 · through 13.1.1