All vulnerabilities
CVE-2026-16491

Grafana Enterprise: CVE-2026-16491 CVE Record

Grafana Grafana EnterpriseApplications & CMS
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder.

This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.

Text from CVE List

Affected versions 4

  • Grafana Enterpriseaffected: 13.0.0 through 13.0.4CVE List
  • Grafana Enterpriseaffected: 13.1.0 through 13.1.1CVE List
  • Grafana Enterpriseaffected: 13.0.0 through 13.1.0CVE List
  • Grafana OSSaffected: 13.0.0 through 13.1.1CVE List

References 1