← CVE Intelligence

CVE-2026-19197

Broken access control in dashboard snapshots PUBLISHED

Description (CNA)

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).

Affected (CNA)

Vendor / productVersions
Grafana / Grafana OSSaffected 12.4.0 before 12.4.8; affected 13.0.0 before 13.0.6; affected 13.1.0 before 13.1.3
Grafana / Grafana Enterpriseaffected 12.4.0 before 12.4.8; affected 13.0.0 before 13.0.6; affected 13.1.0 before 13.1.3

CWE

CWE-862

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.