CVE-2026-11817 CVE-2026-11817 CVE Record
Org Admins in multi-org Grafana deployments can view dashboard permission data from other organizations via an API endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-11817?
CVE-2026-11817 is a medium-severity vulnerability in Grafana Enterprise, published on 17 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only.
Weakness: CWE-863
Which versions are affected by CVE-2026-11817?
1 open source package ship an affected version, including grafana.
| Package | Affected | Fixed in |
|---|---|---|
grafana Bitnami | All versions | 13.1.1 |
How do I fix CVE-2026-11817?
Upgrade grafana to 13.1.1 or later.
Is CVE-2026-11817 being exploited?
There is no known exploitation of CVE-2026-11817 in the wild and no public exploit code.
Sources
Also known as BIT-grafana-2026-11817, GHSA-72xj-fpfg-99ww, MINI-2gvw-cghx-rwcp, MINI-43ff-34wj-8f32, MINI-4jwj-j9cr-pwrg, MINI-53mh-rg6x-j4h8 and 13 more.