RBAC Service Issue in Grafana Affects User Access Control
CVE-2026-16491

6.5MEDIUM

Key Information:

Vendor

Grafana
Status
Grafana Enterprise
Grafana Oss
Vendor
CVE Published:
27 October 2026

What is CVE-2026-16491?

A vulnerability in Grafana's Role-Based Access Control (RBAC) service could allow unauthorized users with specific dashboard management rights to access deleted dashboards from folders where they do not have administrative privileges. This oversight enables users who should be limited to specific folders to gain visibility into content they would normally be barred from, potentially exposing sensitive information. To rectify this flaw, permissions should accurately reflect the specified folder, its parent, or apply a wildcard scope, ensuring that user access aligns with intended controls.

Affected Version(s)

Grafana Enterprise 13.0.0 <= 13.0.4

Grafana Enterprise 13.1.0 <= 13.1.1

Grafana Enterprise Windows 13.0.0 <= 13.1.0

References

https://grafana.com/security/security-advisories/cve-2026...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.