CVE-2026-19197

Broken access control in dashboard snapshots

State: Published
Severity: 6.3 Medium
Published: Aug 26, 2026
Updated: Aug 27, 2026
Reserved: Aug 6, 2026

Description

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).

Scores

CVSS	Score	Vector	Source
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	GRAFANA

Weaknesses

CWE-862

Affected Products

Product	Versions
Grafana OSSGrafana	12.4.0 to before 12.4.8Affected 13.0.0 to before 13.0.6Affected 13.1.0 to before 13.1.3Affected
Grafana EnterpriseGrafana	12.4.0 to before 12.4.8Affected 13.0.0 to before 13.0.6Affected 13.1.0 to before 13.1.3Affected

References

https://grafana.com/security/security-advisories/cve-2026-19197vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.