CVE-2026-76154

CVE-2026-76154 CVE Record

State: Published
Severity: 7.3 High
Published: Sep 17, 2026
Updated: Oct 14, 2026
Reserved: Aug 19, 2026

Description

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N	GRAFANA

Weaknesses

CWE-79

Affected Products

Product	Versions
Grafana OSSGrafana	12.3.0Affected 12.4.0 through 12.4.10Affected 13.0.0 through 13.0.8Affected 13.1.0 through 13.1.5Affected 13.2.0 through 13.2.1Affected
Grafana EnterpriseGrafana	12.3.0Affected 12.4.0 through 12.4.10Affected 13.0.0 through 13.0.8Affected 13.1.0 through 13.1.5Affected 13.2.0 through 13.2.1Affected

References

https://grafana.com/security/security-advisories/cve-2026-76154vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.