CVE-2026-33377
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to escalate privilege.
Risk Assessment
There is a risk that unauthorized users may gain access to sensitive data or administrative functions, potentially leading to serious security breaches.
Recommendation
It is recommended to restrict dashboard access to authorized users only and to conduct regular permission audits.
Other vulnerabilities in Dashboard
See all- CVE-2026-12593High
An internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) failed to enforce sufficient permissions when creating an API token for another user. An attacker knowing the login name of a privileged internal user and authenticated via OAuth/OIDC could forge a token creation request on their behalf.
- CVE-2026-42127High
The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion.
Original NVD description (English source)
An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to the dashboard to escalate privilege.