Skip to content

CVE record · 1 source

CVE-2026-16491

CVSS 6.5

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings.

Vendor: Grafana Labs
Product: Grafana Enterprise, Grafana OSS
CVSS v3.1: 6.5 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-862
Exposure class: Network management

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

10

CVE NVD 6d ago

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings.

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be…

CVSS 6.5 CVE-2026-16491 Grafana Labs