---
id: "CVE-2026-82014"
page: "https://infrastack.ai/live/CVE-2026-82014"
kind: "vulnerability"
aliases: ["CVE-2026-82014"]
title: "Grafana-style dashboard: any logged-in user can change team preferences"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "self-hosted", "teams"]
not_affected_if: ["auth-required"]
published_at: "2026-11-11T15:17:25+00:00"
first_seen_at: "2026-11-11T15:27:50+00:00"
updated_at: "2026-11-11T15:29:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82014", "first_seen_at": "2026-11-11T15:27:50+00:00"}]
exploit_sources: []
---

# Grafana-style dashboard: any logged-in user can change team preferences

Link for people: https://infrastack.ai/live/CVE-2026-82014 (this .md is for agents)

Any signed-in user, including a read-only Viewer, can change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint that has no access check. An attacker can redirect every member of a team to a dashboard of their choice.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-11T15:27:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82014

## From the sources

Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice (missing authorization).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_