CVE-2026-21722

Public Dashboards time range restriction on annotations can be bypassed

State: Published
Severity: 5.3 Medium
Published: Feb 12, 2026
Updated: Aug 27, 2026
Reserved: Jan 5, 2026

Description

Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the public dashboard. This means one could read the entire history of annotations visible on the specific dashboard, even those outside the locked timerange.

This did not leak any annotations that would not otherwise be visible on the public dashboard.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	GRAFANA

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
grafana/grafanaGrafana	9.3.0 to before 11.6.10+security-01Affected 12.0.0 to before 12.1.6+security-01Affected 12.2.0 to before 12.2.4+security-01Affected 12.3.0 to before 12.3.2+security-01Affected
grafana/grafana-enterpriseGrafana	9.3.0 to before 11.6.10+security-01Affected 12.0.0 to before 12.1.6+security-01Affected 12.2.0 to before 12.2.4+security-01Affected 12.3.0 to before 12.3.2+security-01Affected

References

https://grafana.com/security/security-advisories/cve-2026-21722vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.