CVE-2026-21721

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-21721
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21721.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-21721
Aliases
Downstream
CGA (22)
CLSA (1)
MINI (14)
openSUSE (2)
RHSA (4)
RLSA (2)
SUSE (3)
UBUNTU (1)
Related
ALSA (2)
CGA (1)
openSUSE (2)
SUSE (3)
Published
2026-01-27T09:07:55Z
Modified
2026-08-28T11:30:59Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation
Details

The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.

Database specific 
{
    "cna_assigner":  "GRAFANA",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21721.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "12.3.0"
                },
                {
                    "fixed":  "12.3.1"
                },
                {
                    "introduced":  "12.2.0"
                },
                {
                    "fixed":  "12.2.3"
                },
                {
                    "introduced":  "12.1.0"
                },
                {
                    "fixed":  "12.1.5"
                },
                {
                    "introduced":  "12.0.0"
                },
                {
                    "fixed":  "12.0.8"
                },
                {
                    "introduced":  "10.2.0"
                },
                {
                    "fixed":  "11.6.9"
                },
                {
                    "introduced":  "10.2.0"
                },
                {
                    "fixed":  "11.6.9"
                },
                {
                    "introduced":  "12.0.0"
                },
                {
                    "fixed":  "12.0.8"
                },
                {
                    "introduced":  "12.1.0"
                },
                {
                    "fixed":  "12.1.5"
                },
                {
                    "introduced":  "12.2.0"
                },
                {
                    "fixed":  "12.2.3"
                },
                {
                    "introduced":  "12.3.0"
                },
                {
                    "fixed":  "12.3.1"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/grafana/grafana

Affected ranges

Type
GIT
Repo
https://github.com/grafana/grafana
Events
Introduced
ae830f687450b8a0aca94ab2d72cc08853a80fff
Fixed
723a1642e8f43947a8e0c4621face5b3d985e1d2
Introduced
4c0e7045f97f356716755b47183b22e7f12bb4bf
Fixed
e133492ed413438f6a81cd956c8d7712f83f1579
Introduced
ccd7b6ce7ea6184b8c7eb1de044174147dd9a648
Fixed
7b200250e485dcb3f2ace4587786a1e1f45c7d22
Introduced
92f1fba9b4b6700328e99e97328d6639df8ddc3d
Fixed
33436a3f337ea2f1c44aefa5c5ac508763741340
Introduced
723a1642e8f43947a8e0c4621face5b3d985e1d2
Last Affected
0d1a5b4420a5e4579b91c239ecb240ea2b247fba
Database specific
Show details 
{
    "cpe":  [
        "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:grafana:grafana:11.6.9:-:*:*:*:*:*:*",
        "cpe:2.3:a:grafana:grafana:12.0.8:-:*:*:*:*:*:*",
        "cpe:2.3:a:grafana:grafana:12.1.5:-:*:*:*:*:*:*",
        "cpe:2.3:a:grafana:grafana:12.2.3:-:*:*:*:*:*:*",
        "cpe:2.3:a:grafana:grafana:12.3.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:grafana:grafana:12.3.1:-:*:*:*:*:*:*"
    ],
    "extracted_events":  [
        {
            "introduced":  "10.2.0"
        },
        {
            "fixed":  "11.6.9"
        },
        {
            "introduced":  "12.0.0"
        },
        {
            "fixed":  "12.0.8"
        },
        {
            "introduced":  "12.1.0"
        },
        {
            "fixed":  "12.1.5"
        },
        {
            "introduced":  "12.2.0"
        },
        {
            "fixed":  "12.2.3"
        },
        {
            "introduced":  "11.6.9-NA"
        },
        {
            "last_affected":  "11.6.9-NA"
        },
        {
            "introduced":  "12.0.8-NA"
        },
        {
            "last_affected":  "12.0.8-NA"
        },
        {
            "introduced":  "12.1.5-NA"
        },
        {
            "last_affected":  "12.1.5-NA"
        },
        {
            "introduced":  "12.2.3-NA"
        },
        {
            "last_affected":  "12.2.3-NA"
        },
        {
            "introduced":  "12.3.0"
        },
        {
            "last_affected":  "12.3.0"
        },
        {
            "introduced":  "12.3.1-NA"
        },
        {
            "last_affected":  "12.3.1-NA"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

11.*
11.6.9-NA
12.*
12.0.8-NA
12.1.5-NA
12.2.3-NA
12.3.0
12.3.1-NA
v12.*
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.1.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-21721.json"