---
id: "CVE-2026-16491"
kind: "vulnerability"
aliases: ["CVE-2026-16491"]
title: "Grafana: folder admin check lets users list deleted dashboards from other folders"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["grafana", "rbac", "runtime", "self-hosted"]
not_affected_if: ["no-folder-permission-delegation", "single-admin-instance"]
published_at: "2026-10-27T18:17:37+00:00"
first_seen_at: "2026-10-27T18:33:00+00:00"
updated_at: "2026-10-27T18:34:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16491", "first_seen_at": "2026-10-27T18:33:00+00:00"}]
---

# Grafana: folder admin check lets users list deleted dashboards from other folders

Grafana's RBAC service ignored the requested folder when checking folder administrator rights for deleted dashboard listings. A user with dashboard permission-management rights on any one folder could list deleted dashboard items from folders they cannot administer.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Grafana version with `grafana server -v` or the About page in the UI and compare it to the fixed releases listed in the advisory
- Confirm whether the 'Recently deleted' dashboards feature is in use by any non-admin users with folder permission-management rights

## Fix

- Upgrade Grafana to a release that includes the fix for CVE-2026-16491 (fixed versions: unknown)
- Until patched, review which users hold dashboard permission-management rights on any folder and reduce them where possible

## Timeline

- 2026-10-27T18:33:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-16491

## From the sources

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder.

This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_