{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-81842", "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "state": "PUBLISHED", "assignerShortName": "GRAFANA", "dateReserved": "2026-08-27T15:48:54.245Z", "datePublished": "2026-09-29T20:50:01.257Z", "dateUpdated": "2026-09-30T15:28:16.203Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.1.10", "status": "affected", "version": "12.1.0", "versionType": "semver"}, {"lessThanOrEqual": "12.2.11", "status": "affected", "version": "12.2.0", "versionType": "semver"}, {"lessThanOrEqual": "12.3.11", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThan": "12.4.12", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.10", "status": "affected", "version": "13.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.1.10", "status": "affected", "version": "12.1.0", "versionType": "semver"}, {"lessThanOrEqual": "12.2.11", "status": "affected", "version": "12.2.0", "versionType": "semver"}, {"lessThanOrEqual": "12.3.11", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThan": "12.4.12", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.10", "status": "affected", "version": "13.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Dohyun Choi, CIS Lab, SeoulTech"}], "datePublic": "2026-09-29T07:44:02.000Z", "descriptions": [{"lang": "en", "value": "An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination folder (incorrect authorization). No data from the destination folder is disclosed, and existing content there cannot be changed."}], "metrics": [{"cvssV3_1": {"baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "CWE-863", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da", "shortName": "GRAFANA", "dateUpdated": "2026-09-30T13:05:14.168Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://grafana.com/security/security-advisories/cve-2026-81842"}], "source": {"discovery": "BUG_BOUNTY"}, "title": "Library panel can be moved into a folder without library panel create permission"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-81842", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T15:04:07.785889Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-30T15:28:16.203Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Grafana Enterprise", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.1.10", "status": "affected", "version": "12.1.0", "versionType": "semver"}, {"lessThanOrEqual": "12.2.11", "status": "affected", "version": "12.2.0", "versionType": "semver"}, {"lessThanOrEqual": "12.3.11", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThan": "12.4.12", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.10", "status": "affected", "version": "13.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Grafana OSS", "vendor": "Grafana", "versions": [{"lessThanOrEqual": "12.1.10", "status": "affected", "version": "12.1.0", "versionType": "semver"}, {"lessThanOrEqual": "12.2.11", "status": "affected", "version": "12.2.0", "versionType": "semver"}, {"lessThanOrEqual": "12.3.11", "status": "affected", "version": "12.3.0", "versionType": "semver"}, {"lessThan": "12.4.12", "status": "affected", "version": "12.4.0", "versionType": "semver"}, {"lessThan": "13.0.10", "status": "affected", "version": "13.0.0", "versionType": "semver"}]}], "source": "security@grafana.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination folder (incorrect authorization). No data from the destination folder is disclosed, and existing content there cannot be changed."}], "id": "CVE-2026-81842", "lastModified": "2026-09-30T16:19:13.297", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@grafana.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-81842", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-30T15:04:07.785889Z", "version": "2.0.3"}}]}, "published": "2026-09-29T21:19:31.583", "references": [{"source": "security@grafana.com", "url": "https://grafana.com/security/security-advisories/cve-2026-81842"}], "sourceIdentifier": "security@grafana.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security@grafana.com", "type": "Secondary"}]}

{"bugzilla": {"description": "grafana: grafana: Authorization bypass via missing destination folder permission check", "id": "2543653", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543653"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-639", "details": ["A flaw was found in Grafana. The application fails to verify creation permissions on destination folders during panel update operations. An authenticated user with edit permissions in one folder can exploit this vulnerability through the library elements API to move a library panel into a folder where they only possess view permissions. This allows an unauthorized user to bypass access controls and place content into restricted folders."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-81842", "package_state": [{"cpe": "cpe:/a:redhat:multicluster_globalhub", "fix_state": "Fix deferred", "package_name": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9", "product_name": "Multicluster Global Hub"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/acm-grafana-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel9", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "rhceph-ci/grafana", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "rhceph/grafana-rhel10", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "rhel10/grafana", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "rhel9/grafana", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "grafana12.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Fix deferred", "package_name": "grafana13.1", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Fix deferred", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-09-29T20:50:01Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-81842\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-81842\nhttps://grafana.com/security/security-advisories/cve-2026-81842"], "statement": "This vulnerability is rated as having a Moderate impact because exploitation requires an authenticated account with edit rights to at least one folder, and the blast radius is confined to relocating library panels into read-only folders. An attacker cannot read restricted data from the destination location or alter preexisting dashboards and panels. Therefore, the issue does not allow confidentiality loss or arbitrary administrative compromise within Grafana.", "threat_severity": "Moderate"}

{"created": "2026-09-30T13:15:19.181674+00:00", "updated": "2026-09-30T13:45:16.950830+00:00", "vendors": []}