BIT-grafana-2026-13719

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/grafana/BIT-grafana-2026-13719.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-grafana-2026-13719

Aliases

CVE-2026-13719

Published

2026-10-09T10:46:26Z

Modified

2026-10-09T12:00:03Z

Summary

Alert rules in restricted folders disclosed via the alert rules list API

Details

An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.

Database specific

{
    "cpes": [
        "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:*:*:*",
        "cpe:2.3:a:grafana:grafana:*:*:*:*:*:go:*:*",
        "cpe:2.3:a:grafana:grafana:*:*:*:*:enterprise:go:*:*"
    ],
    "severity": "Medium"
}

References

Affected packages

Bitnami / grafana

Package

Name: grafana
Purl: pkg:bitnami/grafana

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

12.3.0

Fixed

12.4.12

Introduced

13.0.0

Fixed

13.0.10

Introduced

13.1.0

Fixed

13.1.7

Introduced

13.2.0

Fixed

13.2.3

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/grafana/BIT-grafana-2026-13719.json"