CVE-2026-21721
High · 8.1CVSS
8.1
EPSS
0.7%
Published
Jan 27, 2026
CISA due date
—
The record
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | grafana-11.4 | 0 | 11.4.8-r3 |
| Chainguard | grafana-fips-11.5 | 0 | 11.5.10-r2 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | golang-github-prometheus-promu | 0 | 0.17.0-150000.3.30.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | grafana | 0 | 11.6.11-150200.3.83.1 |
| SUSE:Manager Client Tools 15 | dracut-saltboot | 0 | 1.1.0-150000.1.65.1 |
| SUSE:Manager Client Tools 15 | golang-github-QubitProducts-exporter_exporter | 0 | 0.4.0-150000.1.21.1 |
| SUSE:Manager Client Tools 15 | golang-github-boynux-squid_exporter | 0 | 1.13.0-150000.1.12.1 |
| SUSE:Manager Client Tools 15 | golang-github-lusitaniae-apache_exporter | 0 | 1.0.10-150000.1.26.1 |
| SUSE:Manager Client Tools 15 | golang-github-prometheus-prometheus | 0 | 3.5.0-150000.3.67.1 |
| SUSE:Manager Client Tools 15 | grafana | 0 | 11.6.11-150000.1.90.1 |
| SUSE:Manager Client Tools 15 | prometheus-blackbox_exporter | 0 | 0.26.0-150000.1.30.2 |
| SUSE:Manager Client Tools 15 | spacecmd | 0 | 5.0.15-150000.3.142.1 |
| SUSE:Manager Client Tools 15 | uyuni-tools | 0 | 0.1.38-150000.1.30.1 |
| SUSE:Manager Client Tools for SLE Micro 5 | dracut-saltboot | 0 | 1.1.0-150000.1.65.1 |
| SUSE:Manager Client Tools for SLE Micro 5 | golang-github-QubitProducts-exporter_exporter | 0 | 0.4.0-150000.1.21.1 |
| SUSE:Manager Client Tools for SLE Micro 5 | prometheus-blackbox_exporter | 0 | 0.26.0-150000.1.30.2 |
| SUSE:Manager Client Tools for SLE Micro 5 | uyuni-tools | 0 | 0.1.38-150000.1.30.1 |
| Wolfi | grafana-11.4 | 0 | 11.4.8-r3 |
| openSUSE:Leap 15.6 | dracut-saltboot | 0 | 1.1.0-150000.1.65.1 |
| openSUSE:Leap 15.6 | golang-github-QubitProducts-exporter_exporter | 0 | 0.4.0-150000.1.21.1 |
| openSUSE:Leap 15.6 | golang-github-boynux-squid_exporter | 0 | 1.13.0-150000.1.12.1 |
| openSUSE:Leap 15.6 | golang-github-lusitaniae-apache_exporter | 0 | 1.0.10-150000.1.26.1 |
| openSUSE:Leap 15.6 | golang-github-prometheus-promu | 0 | 0.17.0-150000.3.30.1 |
| openSUSE:Leap 15.6 | grafana | 0 | 11.6.11-150200.3.83.1 |
| openSUSE:Leap 15.6 | prometheus-blackbox_exporter | 0 | 0.26.0-150000.1.30.2 |
| openSUSE:Leap 15.6 | spacecmd | 0 | 5.0.15-150000.3.142.1 |
| openSUSE:Tumbleweed | grafana | 0 | 11.6.14+security01-1.1 |
Related vulnerabilities
- CVE-2026-21722 Public dashboards with annotations enabled did not limit their annotation timerange to… Also affects grafana-11.4
- CVE-2026-21720 Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. Also affects grafana-11.4
- CVE-2024-6485 A security vulnerability has been discovered in bootstrap that could enable Cross-Site… Also affects grafana-11.4
- CVE-2026-27606 Rollup is a module bundler for JavaScript. Also affects golang-github-prometheus-promu
- CVE-2026-1615 Versions of the package jsonpath before 1.3.0 are vulnerable to Arbitrary Code Injection… Also affects golang-github-prometheus-promu
- CVE-2026-25547 @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Also affects golang-github-prometheus-promu
- CVE-2025-61140 The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution. Also affects golang-github-prometheus-promu
- CVE-2025-13465 Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the… Also affects golang-github-prometheus-promu