Grafana CVE-2026-11817

Exploitation requires three concurrent conditions: the Grafana instance must be deployed in multi-organization mode (single-org deployments are explicitly not affected per vendor description); the attacker must hold the Org Admin role within at least one organization in that stack (PR:L per CVSS 4.0 vector - standard authenticated user or Viewer roles are insufficient); and the target stack must be running one of the affected version ranges spanning 11.2.0 through 13.1.0. What limits exploitation is significant: the Org Admin role is a privileged, deliberately granted account type; the disclosed data is restricted to dashboard/folder UIDs and permission mappings with no content, credentials, or secrets reachable; and the flaw requires a multi-org configuration that, while common in enterprise shared instances, is not the default for self-hosted single-team deployments.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) yields a score of 5.3 (Medium), which accurately reflects the constrained impact. The PR:L metric confirms exploitation requires an authenticated Org Admin - an account with elevated, scoped privilege - ruling out unauthenticated or low-privilege abuse. The VC:L rating is consistent with the description: only UIDs and permission metadata are exposed, not content or credentials, meaningfully capping the blast radius. No EPSS score was included in the intelligence; no CISA KEV listing exists; and no public POC has been identified, all of which further depress real-world urgency relative to the network-accessible attack vector. The most realistic risk is internal reconnaissance: a malicious or compromised Org Admin in one tenant mapping the dashboard structure and user access patterns of other tenants - a meaningful confidentiality concern in shared Grafana environments, but not a full compromise. Single-organization deployments are explicitly immune per vendor description. The practical priority is therefore moderate for multi-org SaaS or enterprise shared-instance deployments, and negligible for single-org installations.

An Org Admin of Organization A in a shared Grafana Enterprise instance authenticates normally and issues a GET request to /api/access-control/users/permissions/search?actionPrefix=dashboards: using their valid session token. The API responds with permission records scoped to all organizations in the stack, revealing the dashboard and folder UIDs of Organization B and C along with which users hold which dashboard permissions in those orgs - information the Org Admin of A has no legitimate right to access. No exploit code is required beyond a standard HTTP client; the endpoint is reachable over the network with valid Org Admin credentials.