PT-2026-2986 · Grafana · Grafana

Published 2026-01-15 · Updated 2026-01-20 · CVE-2026-0713

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Grafana (affected versions not specified)

Description A security issue exists in the /apis/dashboard.grafana.app/* API endpoints, allowing authenticated users to bypass dashboard and folder permissions. This affects all API versions (v0alpha1, v1alpha1, v2alpha1). Specifically, viewers can access all dashboards and folders regardless of assigned permissions. Editors can view, edit, and delete all dashboards and folders, irrespective of permissions, and can create dashboards in any folder. Anonymous users with viewer or editor roles are also affected. Organization isolation remains intact, and the issue is limited to dashboard access, not datasources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-0713

Affected Products

Grafana

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-0713 · Security Note
• https://sick.com/.well-known/csaf/white/2026/sca-2026-0002.pdf · Vendor Advisory
• https://cisa.gov/resources-tools/resources/ics-recommended-practices · Note
• https://sick.com/psirt · Note
• https://sick.com/.well-known/csaf/white/2026/sca-2026-0002.json · Note
• https://sick.com/media/docs/9/19/719/special_information_sick_operating_guidelines_cybersecurity_by_sick_en_im0106719.pdf · Note
• https://first.org/cvss/calculator/3.1 · Note
• https://twitter.com/VulmonFeeds/status/2011838574887346545 · Twitter Post
• https://twitter.com/CVEnew/status/2012490366230938012 · Twitter Post
• https://twitter.com/TheHackerWire/status/2011797398641893398 · Twitter Post
• https://twitter.com/cracbot/status/2013567219452780954 · Twitter Post