CVE-2026-21721
- Source
- https://cve.org/CVERecord?id=CVE-2026-21721
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21721.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-21721
- Aliases
- Downstream
ALSA (2)
CGA (22)
- CGA-2x4w-8q3m-h943
- CGA-32f2-338r-m8cp
- CGA-38r5-cg7j-cv2h
- CGA-3m6p-m9q2-qqxq
- CGA-4784-84v9-x9wc
- CGA-4978-c99x-8r8w
- CGA-66m6-r4vr-v8j9
- CGA-69g8-h5cr-9cfh
- CGA-82g7-jc9h-28pq
- CGA-869r-592g-qp95
- CGA-9xwm-4v6g-hfgm
- CGA-cp9h-q363-vjfq
- CGA-ggfg-5wp4-m48j
- CGA-h7hf-9625-9h9h
- CGA-h9vr-8f9r-f5jj
- CGA-jc47-fwr2-3x9j
- CGA-v2wq-6h77-9vrc
- CGA-vx2q-589x-h7g3
- CGA-w9gg-wrq2-6mc4
- CGA-wrch-pxq6-23qw
- CGA-x3wp-6hq3-8w5h
- CGA-xpxc-p2v5-9r7r
CLSA (1)
MINI (14)
openSUSE (2)
RLSA (2)
UBUNTU (1)
- Related
- Published
- 2026-01-27T09:07:55Z
- Modified
- 2026-10-28T02:31:13Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation
- Details
-
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
- Database specific
{ "cna_assigner": "GRAFANA", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21721.json", "unresolved_ranges": [ { "extracted_events": [ { "range": [ { "introduced": "12.3.0" }, { "fixed": "12.3.1" }, { "introduced": "12.2.0" }, { "fixed": "12.2.3" }, { "introduced": "12.1.0" }, { "fixed": "12.1.5" }, { "introduced": "12.0.0" }, { "fixed": "12.0.8" }, { "introduced": "10.2.0" }, { "fixed": "11.6.9" }, { "introduced": "10.2.0" }, { "fixed": "11.6.9" }, { "introduced": "12.0.0" }, { "fixed": "12.0.8" }, { "introduced": "12.1.0" }, { "fixed": "12.1.5" }, { "introduced": "12.2.0" }, { "fixed": "12.2.3" }, { "introduced": "12.3.0" }, { "fixed": "12.3.1" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] } ] }- References
-
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21721.json
- https://access.redhat.com/errata/RHSA-2026:2914
- https://access.redhat.com/errata/RHSA-2026:2920
- https://access.redhat.com/errata/RHSA-2026:3078
- https://access.redhat.com/errata/RHSA-2026:3529
- https://access.redhat.com/errata/RHSA-2026:41064
- https://access.redhat.com/errata/RHSA-2026:5633
- https://access.redhat.com/errata/RHSA-2026:8229
- https://access.redhat.com/security/cve/CVE-2026-21721
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21721.json
- https://grafana.com/security/security-advisories/cve-2026-21721
- https://nvd.nist.gov/vuln/detail/CVE-2026-21721
- https://bugzilla.redhat.com/show_bug.cgi?id=2433242
Affected packages
Git / github.com/grafana/grafana
Affected ranges
- Type
- GIT
- Repo
- https://github.com/grafana/grafana
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedLast Affected
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "range": [ { "introduced": "10.2.0" }, { "fixed": "11.6.9" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "range": [ { "introduced": "12.0.0" }, { "fixed": "12.0.8" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "range": [ { "introduced": "12.1.0" }, { "fixed": "12.1.5" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "range": [ { "introduced": "12.2.0" }, { "fixed": "12.2.3" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:grafana:grafana:11.6.9:-:*:*:*:*:*:*", "range": [ { "introduced": "11.6.9-NA" }, { "last_affected": "11.6.9-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:grafana:grafana:12.0.8:-:*:*:*:*:*:*", "range": [ { "introduced": "12.0.8-NA" }, { "last_affected": "12.0.8-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:grafana:grafana:12.1.5:-:*:*:*:*:*:*", "range": [ { "introduced": "12.1.5-NA" }, { "last_affected": "12.1.5-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:grafana:grafana:12.2.3:-:*:*:*:*:*:*", "range": [ { "introduced": "12.2.3-NA" }, { "last_affected": "12.2.3-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:grafana:grafana:12.3.0:*:*:*:*:*:*:*", "range": [ { "introduced": "12.3.0" }, { "last_affected": "12.3.0" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:grafana:grafana:12.3.1:-:*:*:*:*:*:*", "range": [ { "introduced": "12.3.1-NA" }, { "last_affected": "12.3.1-NA" } ], "source": "CPE_STRING" } ] }