7 matches found
CVE-2026-82014
Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice missing authorization...
CVE-2026-82014
An authorization bypass in Grafana allows any authenticated user, including those with Viewer privileges, to modify team preferences (such as home dashboard, theme, and timezone). This is possible because an undocumented endpoint lacks proper access control, enabling an attacker to redirect every...
CVE-2026-82014
Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice missing authorization...
CVE-2026-82014 Team preferences RBAC bypass through the set-home-dash endpoint
Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice missing authorization...
PT-2026-145255
Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice missing authorization...
CVE-2026-82014: Grafana: Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme…
Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice missing authorization...
Team preferences RBAC bypass through the set-home-dash endpoint
Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice missing authorization...