Grafana CVE-2026-19197

Exploitation requires an authenticated user account holding the organization administrator role within any organization on the target Grafana instance. This is not the global Grafana server admin role but the per-organization admin role, which can be granted to regular users by server admins or existing org-admins. The vulnerability is relevant only to multi-organization Grafana deployments; single-organization instances have no peer organizations to target. The secret-key-recovery sub-issue further requires that at least one snapshot with a public share key exists in a foreign organization. There is no requirement for a specific non-default configuration - any multi-org Grafana deployment where org-admin credentials can be obtained is in scope. Exploitation is bounded by the requirement for the PR:L privilege level; anonymous or non-admin authenticated users cannot exploit this flaw.

The official CVSS 3.1 score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) accurately reflects moderate severity. Attack complexity is low once org-admin credentials are obtained, and no user interaction is required. The scope is unchanged, meaning the vulnerability does not escape the Grafana process boundary, but cross-organization data access within the same instance effectively constitutes a tenant isolation breach. EPSS data is not provided; however, given the targeted prerequisite of org-admin access and the absence of KEV listing or public POC, real-world mass exploitation is unlikely. The more realistic threat is an insider or compromised org-admin deliberately targeting peer organizations on a shared Grafana instance, which is common in enterprise and managed-service deployments. The secret delete key recovery sub-issue is potentially the higher-impact vector because it could enable persistent unauthorized deletion capability even after the original privileged session ends.

An attacker holding organization administrator credentials on a shared Grafana instance discovers that a peer organization has published dashboard snapshots. They supply the public share key of a target snapshot to the key-recovery endpoint, obtain the secret delete key without any additional authorization, and then call the delete endpoint to destroy snapshots belonging to the other organization. No special tooling is required - standard HTTP API calls suffice given the low attack complexity indicated by AC:L in the CVSS vector.