Grafana RBAC Service Ignores Folder for Deleted Dashboard (CVE-2026-16491)
CVE-2026-16491 Published on October 27, 2026

CVE-2026-16491 CVE Record
Grafanas RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted dashboard items from folders where the user lacked administrative access. The fix requires permission on the specified folder, an ancestor, or a wildcard scope.

Vendor Advisory NVD

Weakness Type

What is an AuthZ Vulnerability?

The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVE-2026-16491 has been classified to as an AuthZ vulnerability or weakness.

Products Associated with CVE-2026-16491

Want to know whenever a new CVE is published for Grafana Labs Grafana? stack.watch will email you.

Grafana Labs Grafana

Affected Versions

Grafana Enterprise:

Version 13.0.0, <= 13.0.4 is affected.
Version 13.1.0, <= 13.1.1 is affected.