CVE-2026-11817 PUBLISHED

CVE-2026-11817 CVE Record

Assigner: GRAFANA
Reserved: 09.06.2026 Published: 17.08.2026 Updated: 17.08.2026

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 5.3

Product Status

Vendor Grafana
Product Grafana OSS
Versions Default: unaffected
  • affected from 12.4.0 to 12.4.5 (incl.)
  • affected from 11.2.0 to 11.6.16 (incl.)
  • affected from 13.0.0 to 13.0.3 (incl.)
  • affected from 13.1.0 to 13.1.0 (incl.)
  • affected from 12.2.0 to 12.2.10 (incl.)
  • affected from 12.3.0 to 12.3.8 (incl.)
Vendor Grafana
Product Grafana Enterprise
Versions Default: unaffected
  • affected from 13.0.0 to 13.0.3 (incl.)
  • affected from 12.2.0 to 12.2.10 (incl.)
  • affected from 11.2.0 to 11.6.16 (incl.)
  • affected from 12.3.0 to 12.3.8 (incl.)
  • affected from 12.4.0 to 12.4.5 (incl.)
  • affected from 13.1.0 to 13.1.0 (incl.)

References

Problem Types

  • CWE-863 CWE