CVE-2026-13719
published 2026-09-30CVE-2026-13719: An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders…
PriorityP425medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.30%
21.3th percentile
An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | grafana | — | — |
| grafana | grafana_enterprise | 12.3.0 – 12.3.11 | — |
| grafana | grafana_enterprise | >= 12.4.0 < 12.4.12 | 12.4.12 |
| grafana | grafana_enterprise | >= 13.0.0 < 13.0.10 | 13.0.10 |
| grafana | grafana_enterprise | >= 13.1.0 < 13.1.7 | 13.1.7 |
| grafana | grafana_enterprise | >= 13.2.0 < 13.2.3 | 13.2.3 |
| grafana | grafana_oss | 12.3.0 – 12.3.11 | — |
| grafana | grafana_oss | >= 12.4.0 < 12.4.12 | 12.4.12 |
| grafana | grafana_oss | >= 13.0.0 < 13.0.10 | 13.0.10 |
| grafana | grafana_oss | >= 13.1.0 < 13.1.7 | 13.1.7 |
| grafana | grafana_oss | >= 13.2.0 < 13.2.3 | 13.2.3 |
| multicluster-globalhub | multicluster-globalhub-grafana-rhel9 | — | — |
| rhacm2 | acm-grafana-rhel9 | — | — |
| rhceph-ci | grafana | — | — |
| rhceph | grafana-rhel10 | — | — |
| rhceph | grafana-rhel9 | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
github.com/grafana/grafana: Grafana: Information disclosure via alert rules list API
vendor_redhat·2026-09-30·CVSS 4.3
CVE-2026-13719 [MEDIUM] CWE-863 github.com/grafana/grafana: Grafana: Information disclosure via alert rules list API
github.com/grafana/grafana: Grafana: Information disclosure via alert rules list API
A flaw was found in Grafana. An authenticated user can query the alert rules list Application Programming Interface (API) to access alert rules stored in restricted folders they lack permission to read. When access restrictions are evaluated and a user has no readable folders, folder filtering is dropped and all alert rules within the organization are returned. This flaw results in unauthorized information disclosure of alert rule configurations, though data source credentials are not exposed.
Statement: This Moderate impact flaw allows an authenticated Grafana user to retrieve alert-rule configurations from folders they cannot read by querying the alert-rule list API. Disclosure is limited to the organi
GHSA
An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint.
ghsa_unreviewed·2026-09-30
CVE-2026-13719 [MEDIUM] CWE-200 An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint.
An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.
No detection rules found.
No public exploits indexed.
2026-09-30
Published