7.1

CVE-2026-33377

Dashboard Import Overwrites ACL — Editor Privilege Escalation to Dashboard Admin

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Grafana ≫ Grafana Version >= 8.5.0 < 11.6.14
Grafana ≫ Grafana Version >= 12.2.0 < 12.2.8
Grafana ≫ Grafana Version >= 12.3.0 < 12.3.6
Grafana ≫ Grafana Version >= 12.4.0 < 12.4.3
Grafana ≫ Grafana Version11.6.14 Update-
Grafana ≫ Grafana Version11.6.14 Updatesecurity01
Grafana ≫ Grafana Version12.2.8 Update-
Grafana ≫ Grafana Version12.2.8 Updatesecurity01
Grafana ≫ Grafana Version12.3.6 Update-
Grafana ≫ Grafana Version12.3.6 Updatesecurity01
Grafana ≫ Grafana Version12.4.3 Update-
Grafana ≫ Grafana Version13.0.0
Grafana ≫ Grafana Version13.0.1 Update-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.23% 0.13
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@grafana.com 7.1 2.8 4.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

https://grafana.com/security/security-advisories/cve-2026-33377
Vendor Advisory