CVE-2026-11817
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
This vulnerability only affects Grafana stacks with multiple organizations. A user who is an Org Admin of one organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data from other organizations. Disclosed data is limited to dashboard/folder UIDs and permission mappings, not content or personal data.
Risk Assessment
Risk of limited cross-organization information disclosure, potentially breaking tenant isolation.
Recommendation
Restrict access to this endpoint or apply vendor patches.
Original NVD description (English source)
This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only.