EUVD-2026-89775
GHSA-9q62-r26p-xcjv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as Editor role
-
DeliveryCraft dashboard-creation API request
-
ExploitInject grafana.app provisioning annotations
-
ExecutionStore metadata without authz check
-
PersistDashboard appears file-provisioned
-
ImpactAdmins cannot update or delete it
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account holding at least the Editor role in the target Grafana organization (PR:L); it cannot be performed anonymously. Exploitation is via the standard dashboard API by supplying the grafana.app/managedBy, grafana.app/managerId, and grafana.app/sourcePath annotations at dashboard creation - no special server configuration or non-default feature toggle is described, so default deployments with Editor users are affected. Limiting factors: impact is confined to the attacker's own organization, no data is disclosed, and the practical effect is that affected dashboards become non-editable/non-deletable through the Grafana UI/API (a management denial), which an administrator may still remediate at the datastore level. |
| Impact | This is a genuine but moderate-severity broken-authorization (CWE-285) issue, not a high-urgency threat. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, 5.4) is internally consistent with the description: an authenticated Editor-role user exploits the flaw over the network with low complexity and no user interaction, achieving limited integrity and availability impact with zero confidentiality exposure. There is no EPSS score, no CISA KEV listing, and no public exploit code provided in the intelligence, so there is no evidence of active or automated exploitation - the risk is that of a low-privilege insider or a compromised Editor account, not an unauthenticated internet-facing attacker. The 'no data exposed' and 'limited to the same organization' qualifiers in the description align with C:N and Scope:Unchanged, confirming this is a low-real-risk, correctly-rated issue rather than an inflated CVSS. Bottom line: real but low-to-moderate priority; patch in normal cycle. No signals conflict. |
| Exploit ScenarioDerived | A user with Editor privileges (or an attacker who has phished/compromised an Editor account) creates a dashboard via the dashboard API and sets the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations, which are stored without an authorization check. The dashboard now falsely appears file-provisioned, so administrators can no longer edit or delete it through Grafana, causing a persistent denial-of-management within that organization. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Grafana's dashboard creation API fails to authorize the file-provisioning annotations grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath, so a user holding only the Editor role can create a dashboard that appears to be file-provisioned and is therefore no longer updatable or deletable by administrators through Grafana. Exploitation needs an authenticated account with at least Editor rights in the target organization (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4) and affects default deployments with Editor users; the impact stays inside the attacker's own organization and no data is exposed, making it a management denial on the affected dashboard rather than a data-breach primitive. No public exploit identified at time of analysis.
RemediationAI
Apply the fixed Grafana release identified in the vendor advisory at https://grafana.com/security/security-advisories/cve-2026-13720, which is the authoritative source for the exact patched version; the available data does not name a specific fix version, so treat the advisory as the release reference (no vendor-released patch version could be confirmed from the supplied input). Until that upgrade is in place, the most effective compensating control is to reduce exposure of the Editor role - map users to Viewer or to narrowly scoped folder/dashboard permissions where they do not need to create dashboards, with the trade-off that legitimate dashboard authors lose the ability to create content until the fix is applied. Administrators can also detect and repair already-affected dashboards by auditing for the grafana.app/managedBy annotation and removing it directly in the Grafana datastore (the dashboard/annotation tables), which restores the normal edit and delete paths but is an unsupported, out-of-band change that requires a database backup and should be followed by a UI/API verification; additionally, monitor dashboard-creation activity for provisioning annotations supplied by Editor accounts so that newly poisoned dashboards are cleaned up promptly, accepting that this is a detective rather than preventive control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-285, improper authorization: the dashboard creation path validated the caller's ability to create dashboards but did not validate whether the caller was permitted to set provisioning metadata. Grafana's provisioning subsystem uses the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations to mark a dashboard as owned and managed by an external source (a provisioning file or pipeline); once present, the UI and API treat the dashboard as read-only, because edits would otherwise be reverted by the provisioning mechanism. By accepting these annotations from an Editor without an authorization check, Grafana lets a lower-privileged user unilaterally place a resource into that managed state, effectively denying administrators the normal update and delete paths for that specific dashboard. The compromise is bounded to the same organization and to the integrity/availability of a single dashboard (I:L/A:L), with no confidentiality impact, and it requires no special server configuration or non-default feature toggle.
Know when Grafana gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Editor role is required so PR:L; network API with low complexity and no interaction; integrity/availability limited to management of dashboards and no data exposure so C:N, I:L, A:L.
Primary rating from Vendor (grafana).
CVSS VectorVendor: grafana
Lifecycle Timeline
2DescriptionCVE.org
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat
Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS
Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability
Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high
Exploit-DB