Description
Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder.
This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Grafana Enterprise | 13.0.0 – ≤ 13.0.4, 13.1.0 – ≤ 13.1.1, 13.0.0 – ≤ 13.1.0 | — |
| Grafana | Grafana OSS | 13.0.0 – ≤ 13.1.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | grafana-13.0 | No fix yet | — |
Advisories 1
- WID-SEC-2026-4208 Grafana: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Oct 27, 2026
References
- https://grafana.com/security/security-advisories/cve-2026-16491 vendor-advisory