Grafana Labs 11.6.x < 12.4.12 / 13.0.x < 13.0.10 / 13.1.x < 13.1.7 / 13.2.x < 13.2.3 Missing Authorization (CVE-2026-81841)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(362625);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/05");

  script_cve_id("CVE-2026-81841");
  script_xref(name:"IAVB", value:"2026-B-0278");

  script_name(english:"Grafana Labs 11.6.x < 12.4.12 / 13.0.x < 13.0.10 / 13.1.x < 13.1.7 / 13.2.x < 13.2.3 Missing Authorization (CVE-2026-81841)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a missing authorization vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Grafana Labs installed on the remote host is 11.6.x through 12.4.x prior to 12.4.12, or 13.0.x
prior to 13.0.10, or 13.1.x prior to 13.1.7, or 13.2.x prior to 13.2.3. It is, therefore, affected by a
missing authorization vulnerability:

  - Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend
    bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without
    authenticating, the configuration of the dashboard's data sources, including stored credentials for data
    sources using browser access (missing authorization). Deleting the shared dashboard does revoke the
    token. (CVE-2026-81841)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://grafana.com/security/security-advisories/cve-2026-81841/");
  script_set_attribute(attribute:"solution", value:
"Update Grafana Labs to 12.4.12, 13.0.10, 13.1.7, 13.2.3 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-81841");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/02");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:grafana:grafana");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("grafana_labs_detect.nbin");
  script_require_keys("installed_sw/Grafana Labs");
  script_require_ports("Services/www", 3000);

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Grafana Labs', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '11.6.0', 'fixed_version': '12.4.12'},
        {'min_version': '13.0.0', 'fixed_version': '13.0.10'},
        {'min_version': '13.1.0', 'fixed_version': '13.1.7'},
        {'min_version': '13.2.0', 'fixed_version': '13.2.3'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);