Bug 2433242 (CVE-2026-21721) - CVE-2026-21721 grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables Cross‑Dashboard Privilege Escalation
Summary: CVE-2026-21721 grafana/grafana/pkg/services/dashboards: Grafana Dashboard Per...
Keywords:
Status: NEW
Alias: CVE-2026-21721
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2433944 2433945 2433935 2433936 2433937 2433938 2433939 2433940 2433941 2433942 2433943
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-01-27 10:02 UTC by OSIDB Bzimport
Modified: 2026-04-24 13:56 UTC (History)
17 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:2914 0 None None None 2026-02-18 11:26:25 UTC
Red Hat Product Errata RHSA-2026:2920 0 None None None 2026-02-18 12:49:37 UTC
Red Hat Product Errata RHSA-2026:3078 0 None None None 2026-02-23 11:38:25 UTC
Red Hat Product Errata RHSA-2026:3529 0 None None None 2026-03-02 11:44:25 UTC

Description OSIDB Bzimport 2026-01-27 10:02:59 UTC 
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
Comment 2 errata-xmlrpc 2026-02-18 11:26:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:2914 https://access.redhat.com/errata/RHSA-2026:2914
Comment 3 errata-xmlrpc 2026-02-18 12:49:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:2920 https://access.redhat.com/errata/RHSA-2026:2920
Comment 4 errata-xmlrpc 2026-02-23 11:38:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:3078 https://access.redhat.com/errata/RHSA-2026:3078
Comment 5 errata-xmlrpc 2026-03-02 11:44:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:3529 https://access.redhat.com/errata/RHSA-2026:3529
Note You need to log in before you can comment on or make changes to this bug.