Bug 2543886 (CVE-2026-13720) - CVE-2026-13720 grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata
Summary: CVE-2026-13720 grafana: grafana: Dashboard modification lockout via forged fi...
Keywords:
Status: NEW
Alias: CVE-2026-13720
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2544008
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-30 11:26 UTC by OSIDB Bzimport
Modified: 2026-09-30 15:53 UTC (History)
18 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-30 11:26:05 UTC 
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.
Note You need to log in before you can comment on or make changes to this bug.