Missing authorization in Grafana exposes deleted dashboard listings
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-862.
Summary
Grafana Enterprise 13.0.0 through 13.0.4 and 13.1.0 through 13.1.1, and Grafana OSS 13.0.0 through 13.1.1, are affected. Grafana's RBAC service ignores the requested folder when checking folder administrator rights for deleted dashboard listings, which is a missing authorization flaw (CWE-862). A remote user with high privileges, such as dashboard permission-management rights on any folder, can be treated as an administrator of every folder and see deleted dashboard items from folders they cannot administer.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Grafana Enterprise or Grafana OSS. Red Hat rates it Moderate and lists Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10 and Red Hat Hardened Images as affected with no plan available.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Multicluster Global Hub | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Hardened Images | Affected | No fix yet |
Timeline
- 2026-10-27 Threatist record created from CVE-2026-16491
- 2026-10-27 Alias added: GHSA-6xjg-5qmq-rh74
- 2026-10-28 Priority changed: MEDIUM → LOW
- 2026-11-04 CISA SSVC decision points changed
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
More Grafana vulnerabilities
- TI-2021-16611 Snapshot authentication bypass in grafana KEVCVSS 3.1CRITICAL 9.8
- TI-2021-19604 Grafana path traversal KEVCVSS 3.1HIGH 7.5
- TI-2024-08600 Grafana SQL Expressions allow for remote code execution CVSS 4.0CRITICAL 9.4
- TI-2023-02931 Authentication bypass by spoofing in Grafana CVSS 3.1CRITICAL 9.8
- TI-2020-10491 The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control… CVSS 3.1HIGH 8.2
- TI-2025-03662 Open redirect in Grafana CVSS 3.1HIGH 7.6
Sources
- CVE-2026-16491 · CVE Program
- CVE-2026-16491 · NVD
- FIRST EPSS
- GHSA-6xjg-5qmq-rh74 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-16491 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences