NetSight
IP …
high8.1

CVE-2026-21721

The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action.

Impact

The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.

Affected products

VendorProductAffected versions
GrafanaGrafana
from 10.2.0 before 11.6.9
from 12.0.0 before 12.0.8
from 12.1.0 before 12.1.5
from 12.2.0 before 12.2.3
Versions 11.6.9, 12.0.8

Weakness classification

CWE-863CWE-639

References