Live › vulnerability › CVE-2026-16491
Go to dashboardGrafana's RBAC service ignored the requested folder when checking folder administrator rights for deleted dashboard listings. A user with dashboard permission-management rights on any one folder could list deleted dashboard items from folders they cannot administer.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 18:33 UTC. All times on this page are UTC.
Grafana instances where non-admin users hold dashboard permission-management rights on at least one folder, so they can view deleted dashboard items in folders they should not reach. Instances where all users are full administrators or have no folder permission-management rights are not exposed by this flaw.
No product ranges from the sources yet.
grafana server -v or the About page in the UI and compare it to the fixed releases listed in the advisoryEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder.
This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.
This page as .md · .json · in your agent: get_signal("CVE-2026-16491")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.