CVE-2026-76154 — CVE-2026-76154 CVE Record

Description (CNA)

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.

Affected (CNA)

Vendor / product	Versions
Grafana / Grafana OSS	affected 12.3.0; affected 12.4.0 through 12.4.10; affected 13.0.0 through 13.0.8; affected 13.1.0 through 13.1.5; affected 13.2.0 through 13.2.1
Grafana / Grafana Enterprise	affected 12.3.0; affected 12.4.0 through 12.4.10; affected 13.0.0 through 13.0.8; affected 13.1.0 through 13.1.5; affected 13.2.0 through 13.2.1

CWE

CWE-79

References

https://grafana.com/security/security-advisories/cve-2026-76154

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.