Bug 2543653 (CVE-2026-81842)
| Summary: | CVE-2026-81842 grafana: grafana: Authorization bypass via missing destination folder permission check | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | amctagga, aoconnor, bniver, flucifre, gmeno, gparvin, groman, jbalunas, lchilton, mbenjamin, mhackett, rhaigner, rhel-process-autobot, sfeifer, sostapov, tsze, vereddy, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Grafana. The application fails to verify creation permissions on destination folders during panel update operations. An authenticated user with edit permissions in one folder can exploit this vulnerability through the library elements API to move a library panel into a folder where they only possess view permissions. This allows an unauthorized user to bypass access controls and place content into restricted folders.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2543802 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-09-29 21:07:06 UTC
|