← CVE Intelligence

CVE-2026-21721

Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation PUBLISHED

Description (CNA)

The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.

Affected (CNA)

Vendor / productVersions
Grafana / grafana/grafanaaffected 12.3.0 before 12.3.1
Grafana / grafana/grafanaaffected 12.2.0 before 12.2.3
Grafana / grafana/grafanaaffected 12.1.0 before 12.1.5
Grafana / grafana/grafanaaffected 12.0.0 before 12.0.8
Grafana / grafana/grafanaaffected 10.2.0 before 11.6.9
Grafana / grafana/grafana-enterpriseaffected 10.2.0 before 11.6.9
Grafana / grafana/grafana-enterpriseaffected 12.0.0 before 12.0.8
Grafana / grafana/grafana-enterpriseaffected 12.1.0 before 12.1.5
Grafana / grafana/grafana-enterpriseaffected 12.2.0 before 12.2.3
Grafana / grafana/grafana-enterpriseaffected 12.3.0 before 12.3.1

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

An authorization error has been discovered in Grafana dashboards. The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.