Vulnerabilities

TI-2026-11566 CVE-2026-13720 · GHSA-9q62-r26p-xcjv

Editor can forge file-provisioning provenance on dashboards via the dashboard API

LOW 24

An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00157 Published 2026-09-30 Partial fix · 12.4.12, 13.0.10 +2 CWE-285

TI-2026-11565 CVE-2026-13719 · GHSA-46f2-3vm3-9h7j

Alert rules in restricted folders disclosed via the alert rules list API

LOW 20

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00239 Published 2026-09-30 Partial fix · 12.4.12, 13.0.10 +2 CWE-200

Vulnerabilities

Filters

Editor can forge file-provisioning provenance on dashboards via the dashboard API

Alert rules in restricted folders disclosed via the alert rules list API