CVE-2026-21721: Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-27 · updated 2026-07-20
Weakness: CWE-863

Description

The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.

Affected products

Grafana: from 10.2.0 before 11.6.9; from 12.0.0 before 12.0.8; from 12.1.0 before 12.1.5; from 12.2.0 before 12.2.3; 11.6.9, 12.0.8, 12.1.5, 12.2.3, 12.3.0, 12.3.1 — fixed in 11.6.9, 12.0.8, 12.1.5, 12.2.3

How to fix

Upgrade to a fixed version: Grafana 11.6.9, 12.0.8, 12.1.5, 12.2.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-21721 or the next vulnerability affects your stack