Grafana Labs 11.2.0 <= 11.6.16 / 12.2.0 <= 12.2.10 / 12.3.0 <= 12.3.8 / 12.4.0 <= 12.4.5 / 13.0.0 <= 13.0.3 / 13.1.0 < 13.1.1 Information Disclosure (CVE-2026-11817)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338327);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/20");

  script_cve_id("CVE-2026-11817");

  script_name(english:"Grafana Labs 11.2.0 <= 11.6.16 / 12.2.0 <= 12.2.10 / 12.3.0 <= 12.3.8 / 12.4.0 <= 12.4.5 / 13.0.0 <= 13.0.3 / 13.1.0 < 13.1.1 Information Disclosure (CVE-2026-11817)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by an information disclosure vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Grafana Labs installed on the remote host is 11.2.x through 11.6.x prior or equal to 11.6.16, 12.2.x
prior or equal to 12.2.10, 12.3.x prior or equal to 12.3.8, 12.4.x prior or equal to 12.4.5, 13.0.x prior or equal to
13.0.3, or 13.1.0. It is, therefore, affected by an information disclosure vulnerability:

  - This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization
    deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single
    organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive
    permission data belonging to other organizations. The disclosed data is limited to dashboard and folder
    identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which
    dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data
    are not exposed. This is a limited cross-organization information disclosure affecting multi-org
    deployments only. (CVE-2026-11817)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://grafana.com/security/security-advisories/cve-2026-11817");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Grafana 13.1.1 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-11817");
  script_cwe_id(863);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/20");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:grafana:grafana");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("grafana_labs_detect.nbin");
  script_require_keys("installed_sw/Grafana Labs", "Settings/ParanoidReport");
  script_require_ports("Services/www", 3000);

  exit(0);
}

include('vdf.inc');

# Cannot determine whether the Grafana stack is configured with multiple organizations
if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Grafana Labs', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '11.2.0', 'max_version': '11.6.16', 'fixed_display': '13.1.1'},
        {'min_version': '12.2.0', 'max_version': '12.2.10', 'fixed_display': '13.1.1'},
        {'min_version': '12.3.0', 'max_version': '12.3.8', 'fixed_display': '13.1.1'},
        {'min_version': '12.4.0', 'max_version': '12.4.5', 'fixed_display': '13.1.1'},
        {'min_version': '13.0.0', 'max_version': '13.0.3', 'fixed_display': '13.1.1'},
        {'min_version': '13.1.0', 'fixed_version': '13.1.1'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);