Grafana CVE-2026-16491

The attacker must hold a valid authenticated Grafana account that has been granted dashboard permission-management rights on at least one folder (per CVSS PR:H); with that single grant, the broken RBAC check treats them as administrator of every folder specifically for the deleted-dashboard listing path. Exploitation is limited to exposing deleted dashboard items/listings - it does not grant general folder administration or modification. Limiting factors: requires the elevated permission-management role (not available to default viewers or unauthenticated users), applies to the deleted dashboard listing feature, and only affects the listed 13.0.x-13.1.x branches of Grafana OSS and Enterprise. The fix enforces that the user must have permission on the specified folder, an ancestor folder, or a wildcard scope.

This is a moderate, access-control (CWE-862 Missing Authorization) disclosure flaw, not a critical remote-code or authentication issue. The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N = 6.5) shows the single most important limiting signal: PR:H - exploitation requires an authenticated account that already holds dashboard permission-management (folder-admin) rights on at least one folder, which is an elevated, deliberately granted privilege rather than something any low-privileged or anonymous user has. The decision label is 'this_month', not act_now or emergency, consistent with a privilege-scoped information-exposure bug. No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. One internal inconsistency should be flagged: the description only describes exposure of deleted dashboard items (a read/confidentiality effect), yet the vendor vector sets I:H (integrity high) and C:H; the described mechanism does not substantiate an integrity impact, so the real-world severity is likely lower than 6.5 and is primarily confidentiality-bounded - verify the integrity claim with Grafana before treating it as data-tampering risk.

An authenticated Grafana user who has been granted dashboard permission-management rights on just one folder requests the listing of deleted dashboards; because the RBAC service ignores the requested folder scope for that check, it treats the user as a folder administrator everywhere and returns deleted dashboard items from folders where the user has no administrative access. No public exploit identified at time of analysis; the attack is a straightforward authorized API request abusing the broken scope check.