CVE-2026-82014

EUVD-2026-123538
Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice (missing authorization).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GRAFANACNA
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
grafanagrafana
5.4.0 ≤
𝑥
≤ 11.5.10
CNA
grafanagrafana
11.6.0 ≤
𝑥
≤ 11.6.16
CNA
grafanagrafana
12.0.0 ≤
𝑥
≤ 12.0.10
CNA
grafanagrafana
12.1.0 ≤
𝑥
≤ 12.1.10
CNA
grafanagrafana
12.2.0 ≤
𝑥
≤ 12.2.11
CNA
grafanagrafana
12.3.0 ≤
𝑥
≤ 12.3.11
CNA
grafanagrafana
12.4.0 ≤
𝑥
≤ 12.4.14
CNA
grafanagrafana
13.0.0 ≤
𝑥
≤ 13.0.12
CNA
Common Weakness Enumeration
References
https://grafana.com/security/security-advisories/cve-2026-82014