CVE-2026-13720

EUVD-2026-89775
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GRAFANACNA
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 4.94%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
grafanagrafana
12.0.0 ≤
𝑥
≤ 12.0.10
CNA
grafanagrafana
12.1.0 ≤
𝑥
≤ 12.1.10
CNA
grafanagrafana
12.2.0 ≤
𝑥
≤ 12.2.11
CNA
grafanagrafana
12.3.0 ≤
𝑥
≤ 12.3.11
CNA
grafanagrafana
12.4.0 ≤
𝑥
< 12.4.12
CNA
grafanagrafana
13.0.0 ≤
𝑥
< 13.0.10
CNA
grafanagrafana
13.1.0 ≤
𝑥
< 13.1.7
CNA
grafanagrafana
13.2.0 ≤
𝑥
< 13.2.3
CNA
Common Weakness Enumeration
References
https://grafana.com/security/security-advisories/cve-2026-13720