Grafana Enterprise vulnerabilities

CVE-2026-11817 [MEDIUM] CWE-863 CVE-2026-11817: This vulnerability only affects Grafana stacks configured with multiple organizations; single-organi This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other o

CVE-2023-0594 [MEDIUM] CWE-79 CVE-2023-0594: Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this will be rendered when the span's attributes/resources are

CVE-2026-81841 [MEDIUM] CWE-862 CVE-2026-81841: Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve fro Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing aut

CVE-2026-13720 [MEDIUM] CWE-285 CVE-2026-13720: An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and g An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it

CVE-2026-95502 [MEDIUM] CWE-409 CVE-2026-95502: A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memor A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server.

CVE-2025-3454 [MEDIUM] CWE-285 CVE-2025-3454: This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by a This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources that implement route-specific permi

CVE-2024-6322 [MEDIUM] CWE-266 CVE-2024-6322: Access control for plugin data sources protected by the ReqActions json field of the plugin.json is Access control for plugin data sources protected by the ReqActions json field of the plugin.json is bypassed if the user or service account is granted associated access to any other data source, as the ReqActions check was not scoped to each specific datasource. The account must have prior query access to the impacted datasource.

CVE-2023-6152 [MEDIUM] CWE-863 CVE-2023-6152: A user changing their email after signing up and verifying it can change it without verification in A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up.

CVE-2023-2801 [MEDIUM] CWE-820 CVE-2023-2801: Grafana is an open-source platform for monitoring and observability. Using public dashboards users Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by callin

CVE-2026-13719 [MEDIUM] CWE-200 CVE-2026-13719: An authenticated user can list alert rules stored in folders they are not allowed to read through th An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The ex

CVE-2026-81842 [MEDIUM] CWE-863 CVE-2026-81842: An authenticated user with edit permission on one folder can move a library panel into another folde An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination folder (incorrect authorization). No data from the desti

CVE-2023-1410 [MEDIUM] CWE-79 CVE-2023-1410: Grafana is an open-source platform for monitoring and observability. Grafana had a stored XSS vuln Grafana is an open-source platform for monitoring and observability. Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip. The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized. An attacker needs to have control over the Graphite data source in order to manipulate a

CVE-2026-28378 [LOW] CWE-284 CVE-2026-28378: The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admi The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public dashboards belonging to a different organization by supplying the target dashboard's identifiers.