EUVD-2026-111233

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted...

CVE-2026-16491

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted...

CVE-2026-16491 CVE-2026-16491 CVE Record

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted...

CVE-2026-16491

In Grafana , a vulnerability exists in the RBAC service where it fails to properly validate the requested folder when verifying if a user is a folder administrator for deleted dashboard listings . Due to this Missing Authorization (CWE-862), a user possessing dashboard permission-management right...