CVE-2026-11817

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET...

UBUNTU-CVE-2026-11817

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET...

CVE-2026-11817

CVE-2026-11817 is a CVSS 5.3 medium-severity issue in Grafana multi-org stacks: an Org Admin can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: to view dashboard/folder UIDs and per-user permission mappings from other organizations. Dashboard contents, secrets, and...

CVE-2026-11817 CVE-2026-11817 CVE Record

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET...

CVE-2026-11817 CVE-2026-11817 CVE Record

This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET...

CVE-2026-55062

creationtimestamp| type| source ---|---|--- 2026-08-17 20:35:09+00:00| published-proof-of-concept| https://github.com/uniget-org/cli/security/advisories/GHSA-m6jg-wr9m-cg2f...

PT-2026-76829

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description In deployments configured with multiple organizations, an Org Admin of a single organization can access permission data from other organizations. This occurs when calling the 'GET...

ROOT-APP-MAVEN-CVE-2024-38808 CVE-2024-38808 in org.springframework:spring-expression - Patched by Root

Root has patched CVE-2024-38808 in the org.springframework:spring-expression package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2023-20861 CVE-2023-20861 in org.springframework:spring-expression - Patched by Root

Root has patched CVE-2023-20861 in the org.springframework:spring-expression package for Root:Maven. Multiple fixed versions available...

CVE-2026-58427

Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...

CVE-2026-57897

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...

CVE-2026-58427

Gitea is vulnerable to an information disclosure flaw where private organization member lists are leaked via the /members API endpoint. This issue stems from an incomplete fix in PR #38145 , where the ListMembers() function in routers/api/v1/org/member.go fails to include a visibility check. Cons...

CVE-2026-57897 Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...

CLEANSTART-2026-VJ34421 Security fixes in grafana-org-operator 1.13.0-r0

Package grafana-org-operator version 1.13.0-r0 fixes 16 vulnerabilities: CVE-2026-33186, CVE-2026-25681, CVE-2026-27136, CVE-2026-27141, CVE-2026-33814...

CVE-2026-58427: Exposure of Sensitive Information to an Unauthorized Actor

Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...

CVE-2026-57897: Exposure of Sensitive Information to an Unauthorized Actor

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...

CVE-2026-18652

Velociraptor exposes a data-access issue in the GUI where the path prefix deny check can be bypassed, enabling read access to stacked result sets across tenant orgs. The multi-tenant design stores sub-org data under a shared datastore directory, and a user with read access to the root org can acc...

CVE-2026-18652

Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets to read from denied prefixes. In particular, a...

FreeBSD : gitea -- Multiple vulnerabilities (f4af92f7-95ae-11f1-a6f7-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the f4af92f7-95ae-11f1-a6f7-b42e991fc52e advisory. Gitea reports This release addresses the following security vulnerabilities. Please upgrade as...

CVE-2026-18860

Velociraptor allows multi-tenant deployments named "Orgs". By default Velociraptor, uses the ROOT org, but users can create child orgs for other tenants within the same deployment. Users can have different permissions in each org. To manage Orgs, Velociraptor usually examines the ORGADMIN...