Grafana 13.1.0 Alert Rules API Info Exposure via Folder Filter
CVE-2026-13719 Published on September 30, 2026
Alert rules in restricted folders disclosed via the alert rules list API
An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When the set of folders the user may read was empty, the folder restriction was dropped and every alert rule in the organization was returned. From Grafana 13.1.0, any user can trigger this with a folder filter. The exposed data is rule configuration; data source credentials are not exposed.
Weakness Types
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-13719 has been classified to as an AuthZ vulnerability or weakness.
What is an Information Disclosure Vulnerability?
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVE-2026-13719 has been classified to as an Information Disclosure vulnerability or weakness.
Products Associated with CVE-2026-13719
Want to know whenever a new CVE is published for Grafana Labs Grafana? stack.watch will email you.
Affected Versions
Grafana Enterprise:- Version 12.3.0, <= 12.3.11 is affected.
- Version 12.4.0 and below 12.4.12 is affected.
- Version 13.0.0 and below 13.0.10 is affected.
- Version 13.1.0 and below 13.1.7 is affected.
- Version 13.2.0 and below 13.2.3 is affected.
- Version 12.3.0, <= 12.3.11 is affected.
- Version 12.4.0 and below 12.4.12 is affected.
- Version 13.0.0 and below 13.0.10 is affected.
- Version 13.1.0 and below 13.1.7 is affected.
- Version 13.2.0 and below 13.2.3 is affected.