PT-2026-4878 · Unknown+2 · Dashboard Permissions Api+2

Se1En · Published 2026-01-27 · Updated 2026-04-22 · CVE-2026-21721

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions versions prior to 2026-21721

Description The dashboard permissions API does not verify the target dashboard scope, only checking the dashboards.permissions:* action. This allows a user with permission management rights on one dashboard to read and modify permissions on other dashboards, resulting in a privilege escalation. The API endpoint in question is the dashboard permissions API. The vulnerable action is dashboards.permissions:*.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Improper Privilege Management

Incorrect Authorization

Weakness Enumeration

CWE-269

CWE-863

Related Identifiers

ALSA-2026:2914

ALSA-2026:2920

BDU:2026-01120

BIT-GRAFANA-2026-21721

CVE-2026-21721

OPENSUSE-SU-2026:10601-1

RHSA-2026:2914

RHSA-2026:2920

RHSA-2026:3078

RHSA-2026:3529

SUSE-SU-2026:1013-1

SUSE-SU-2026:1037-1

SUSE-SU-2026:1524-1

Affected Products

Grafana

Red Os

Dashboard Permissions Api

References · 103

• https://grafana.com/security/security-advisories/cve-2026-21721 · Vendor Advisory
• https://grafana.com/security/security-advisories/CVE-2026-21721 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2026-2920.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-21721 · Security Note
• https://linux.oracle.com/errata/ELSA-2026-2920.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21721 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1524-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:2920 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-21721 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:2914 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01120 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1013-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-21721 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10601-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1037-1 · Vendor Advisory