{"id":"CVE-2026-16491","kind":"vulnerability","aliases":["CVE-2026-16491"],"related":[],"title":"Grafana: folder admin check lets users list deleted dashboards from other folders","description":"Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder.\n\nThis could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.","summary":"Grafana's RBAC service ignored the requested folder when checking folder administrator rights for deleted dashboard listings. A user with dashboard permission-management rights on any one folder could list deleted dashboard items from folders they cannot administer.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["grafana","rbac","runtime","self-hosted"],"not_affected_if":["no-folder-permission-delegation","single-admin-instance"],"how_to_check":"- Check the Grafana version with `grafana server -v` or the About page in the UI and compare it to the fixed releases listed in the advisory\n- Confirm whether the 'Recently deleted' dashboards feature is in use by any non-admin users with folder permission-management rights","fix":"- Upgrade Grafana to a release that includes the fix for CVE-2026-16491 (fixed versions: unknown)\n- Until patched, review which users hold dashboard permission-management rights on any folder and reduce them where possible","status":"open","published_at":"2026-10-27T18:17:37+00:00","first_seen_at":"2026-10-27T18:33:00+00:00","triaged_at":"2026-10-27T18:34:46+00:00","updated_at":"2026-10-27T18:34:46+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-27T18:34:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Grafana to a release that includes the fix for CVE-2026-16491 (fixed versions: unknown)\n- Until patched, review which users hold dashboard permission-management rights on any folder and reduce them where possible","reach":"network","title":"Grafana: folder admin check lets users list deleted dashboards from other folders","impact":"low","summary":"Grafana's RBAC service ignored the requested folder when checking folder administrator rights for deleted dashboard listings. A user with dashboard permission-management rights on any one folder could list deleted dashboard items from folders they cannot administer.","category":"runtime","nicknames":[],"who_cares":["grafana","self-hosted","rbac"],"confidence":0.7,"needs_auth":"yes","worst_case":"A low-privileged user reads deleted dashboards from folders they should not access","analyst_note":"Find the fixed Grafana versions and the advisory at the NVD link or Grafana security announcements, since the sources give no version data.","how_to_check":"- Check the Grafana version with `grafana server -v` or the About page in the UI and compare it to the fixed releases listed in the advisory\n- Confirm whether the 'Recently deleted' dashboards feature is in use by any non-admin users with folder permission-management rights","needs_analyst":true,"not_affected_if":["single-admin-instance","no-folder-permission-delegation"],"who_is_affected":"Grafana instances where non-admin users hold dashboard permission-management rights on at least one folder, so they can view deleted dashboard items in folders they should not reach. Instances where all users are full administrators or have no folder permission-management rights are not exposed by this flaw.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000638,"input_tokens":3349,"output_tokens":607,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-16491':15A,18A '-2026':14A,17A 'access':119C 'admin':3A 'administ':63B 'administr':36B,80C,102C,118C 'ancestor':129C 'cannot':62B 'check':4A,34B,73C 'could':54B,96C,107C 'cve':13A,16A 'dashboard':9A,40B,45B,57B,83C,88C,110C 'delet':8A,39B,56B,82C,109C 'everi':104C 'expos':108C 'fix':121C 'folder':2A,12A,32B,35B,53B,60B,71C,79C,95C,105C,113C,127C 'grafana':1A,19B,25B,64C 'host':24B 'ignor':29B,68C 'item':58B,111C 'lack':117C 'let':5A 'list':7A,41B,55B,84C 'manag':48B,91C 'one':52B 'permiss':47B,90C,123C 'permission-manag':46B,89C 'rbac':20B,27B,66C 'request':31B,70C 'requir':122C 'right':37B,49B,92C 'runtim':21B 'scope':133C 'self':23B 'self-host':22B 'servic':28B,67C 'specifi':126C 'therefor':97C 'treat':99C 'user':6A,43B,76C,86C,116C 'whether':74C 'wildcard':132C","nicknames":[],"mitigations":[],"who_affected":"Grafana instances where non-admin users hold dashboard permission-management rights on at least one folder, so they can view deleted dashboard items in folders they should not reach. Instances where all users are full administrators or have no folder permission-management rights are not exposed by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T18:17:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security@grafana.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16491","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16491","severity":null,"published_at":"2026-10-27T18:17:37+00:00","modified_at":"2026-10-27T18:17:37+00:00","first_seen_at":"2026-10-27T18:33:00+00:00","fetched_at":"2026-10-27T18:33:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}