{"id":"CVE-2026-82014","kind":"vulnerability","aliases":["CVE-2026-82014"],"related":[],"title":"Grafana-style dashboard: any logged-in user can change team preferences","description":"Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice (missing authorization).","summary":"Any signed-in user, including a read-only Viewer, can change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint that has no access check. An attacker can redirect every member of a team to a dashboard of their choice.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","self-hosted","teams"],"not_affected_if":["auth-required"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-11T15:17:25+00:00","first_seen_at":"2026-11-11T15:27:50+00:00","triaged_at":"2026-11-11T15:29:51+00:00","updated_at":"2026-11-11T15:29:51+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-11T15:29:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Grafana-style dashboard: any logged-in user can change team preferences","impact":"low","summary":"Any signed-in user, including a read-only Viewer, can change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint that has no access check. An attacker can redirect every member of a team to a dashboard of their choice.","audience":"businesses","category":"other","nicknames":[],"who_cares":["self-hosted","teams"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Team members redirected to attacker-chosen dashboards; team settings altered","analyst_note":"Identify the affected product and versions from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-82014); the sources give no product or fixed version.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000659,"input_tokens":4534,"output_tokens":411,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-82014':16A,19A 'access':58B,102C 'attack':61B 'authent':76C 'author':119C 'chang':11A,37B,82C 'check':59B 'choic':74B,117C 'control':103C 'could':81C 'cve':14A,17A 'dashboard':4A,47B,71B,92C,114C 'endpoint':54B,99C 'everi':64B,107C 'grafana':2A 'grafana-styl':1A 'home':46B,91C 'host':23B 'includ':30B,78C 'log':7A 'logged-in':6A 'member':65B,108C 'miss':118C 'prefer':13A,39B,84C 'read':33B 'read-on':32B 'redirect':63B,106C 'self':22B 'self-host':21B 'sign':27B 'signed-in':26B 'style':3A 'team':12A,24B,42B,68B,87C,111C 'theme':48B,93C 'timezon':50B,95C 'undocu':53B,98C 'user':9A,29B,77C 'viewer':35B,80C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","selfhosted","teams"],"campaign_type":null,"search_a":"'-2026':15A,18A '-82014':16A,19A 'chang':11A 'cve':14A,17A 'dashboard':4A 'grafana':2A 'grafana-styl':1A 'log':7A 'logged-in':6A 'prefer':13A 'style':3A 'team':12A 'user':9A","search_b":"'access':58B 'attack':61B 'chang':37B 'check':59B 'choic':74B 'dashboard':47B,71B 'endpoint':54B 'everi':64B 'home':46B 'host':23B 'includ':30B 'member':65B 'prefer':39B 'read':33B 'read-on':32B 'redirect':63B 'self':22B 'self-host':21B 'sign':27B 'signed-in':26B 'team':24B,42B,68B 'theme':48B 'timezon':50B 'undocu':53B 'user':29B 'viewer':35B","search_c":"'access':102C 'authent':76C 'author':119C 'chang':82C 'choic':117C 'control':103C 'could':81C 'dashboard':92C,114C 'endpoint':99C 'everi':107C 'home':91C 'includ':78C 'member':108C 'miss':118C 'prefer':84C 'redirect':106C 'team':87C,111C 'theme':93C 'timezon':95C 'undocu':98C 'user':77C 'viewer':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T15:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"security@grafana.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82014","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82014","severity":null,"published_at":"2026-11-11T15:17:25+00:00","modified_at":"2026-11-11T15:17:25+00:00","first_seen_at":"2026-11-11T15:27:50+00:00","fetched_at":"2026-11-11T15:27:50+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}