CVE-2026-13720

5.4 Moyenne

Publiée le 30/09/2026 à 13:16 · Modifiée le 30/09/2026 à 19:23 · En attente d'analyse NVD · Source : security@grafana.com

Description

An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.

Traduire en français

Produits concernés

Grafana OSS
Grafana Enterprise

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.4 Moyenne	security@grafana.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L`

Faiblesses (CWE)

CWE-285
CWE-345
CWE-915

Références

https://grafana.com/security/security-advisories/cve-2026-13720

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories