CVE-2026-82014

An authorization bypass in Grafana allows any authenticated user, including those with Viewer privileges, to modify team preferences (such as home dashboard, theme, and timezone). This is possible because an undocumented endpoint lacks proper access control, enabling an attacker to redirect every...

CVE-2026-82014 Team preferences RBAC bypass through the set-home-dash endpoint

Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice missing authorization...

Team preferences RBAC bypass through the set-home-dash endpoint

Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice missing authorization...