Grafana Cross-Org Info Disclosure via /api/access-control
CVE-2026-11817 Published on August 17, 2026
CVE-2026-11817 CVE Record
This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-11817 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-11817
Want to know whenever a new CVE is published for Grafana Labs Grafana? stack.watch will email you.
Affected Versions
Grafana OSS:- Version 12.4.0, <= 12.4.5 is affected.
- Version 11.2.0, <= 11.6.16 is affected.
- Version 13.0.0, <= 13.0.3 is affected.
- Version 13.1.0, <= 13.1.0 is affected.
- Version 12.2.0, <= 12.2.10 is affected.
- Version 12.3.0, <= 12.3.8 is affected.
- Version 13.0.0, <= 13.0.3 is affected.
- Version 12.2.0, <= 12.2.10 is affected.
- Version 11.2.0, <= 11.6.16 is affected.
- Version 12.3.0, <= 12.3.8 is affected.
- Version 12.4.0, <= 12.4.5 is affected.
- Version 13.1.0, <= 13.1.0 is affected.