CVE-2026-106472 Server-side request forgery in the Prometheus data source resource API

Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server without restricting it to the supported API endpoints missing path allowlist. A user with permission to query the data source can read responses from other endpoints on that server...

CVE-2026-106472

The Grafana Prometheus data source is vulnerable to a Server-side Request Forgery (SSRF) due to a missing path allowlist. The application passes the resource path provided by the caller directly to the configured Prometheus server without restriction. Consequently, a user with permissions to quer...

CVE-2026-14242

A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks incorrect authorization...

CVE-2026-111000

A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API refuses the same move improper...

CVE-2026-111000

A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API refuses the same move improper...

EUVD-2026-123541

A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API refuses the same move improper...

EUVD-2026-123537

A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks incorrect authorization...

CVE-2026-14242

A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks incorrect authorization...

PT-2026-145248

A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API refuses the same move improper...

CVE-2026-14242: Grafana: A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had…

A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks incorrect authorization...

CVE-2026-111000: Grafana: A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they…

A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API refuses the same move improper...

PT-2026-145254

A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks incorrect authorization...

EUVD-2026-69726

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the...

CVE-2026-84423

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the...

CVE-2026-84423

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the...

CVE-2026-84423 Casdoor upload-resource API resource.go missing authentication

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the...

CVE-2026-84423 Casdoor upload-resource API resource.go missing authentication

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the...

CVE-2026-84423

Casdoor versions up to 4.0.0 are affected by a missing authentication vulnerability in the upload-resource API , specifically in the controllers/resource.go file. The flaw allows a remote, unauthenticated attacker to perform an arbitrary file upload via the upload-resource endpoint. The exploit h...

CVE-2026-84423 Casdoor upload-resource API resource.go missing authentication

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the...

PT-2026-84534

Name of the Vulnerable Software and Affected Versions Casdoor versions prior to 4.0.0 Description An issue exists in the upload-resource API within the controllers/resource.go file. This flaw allows remote attackers to bypass authentication, leading to missing authentication for the affected...