6.5
MediumCVSS 3.1 · from GRAFANA
CVE-2026-16491
CVE-2026-16491 CVE Record
Grafana Enterprise · Missing authorization · CWE-862AffectedGrafana Enterprise, Grafana Enterprise, Grafana OSS
FixNo fix listed yet.
PublishedOct 27, 17:21 · GRAFANA
ScoredOct 27 · 6.5 · GRAFANA
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
A successful attack can read data and change data. CVSS impact.
Description
Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.
From GRAFANA
Affected and fixed versions
ProductAffectedFixed inGrafana Enterprise13.0.0 – 13.0.4–Grafana Enterprise13.1.0 – 13.1.1–Grafana Enterprise13.0.0 – 13.1.0–Grafana OSS13.0.0 – 13.1.1–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known