CVE-2026-13720 Editor can forge file-provisioning provenance on dashboards via the dashboard API
An Editor can forge file-provisioning metadata on dashboards via the API, preventing administrators from updating or deleting them.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-13720?
CVE-2026-13720 is a medium-severity missing authorization vulnerability in Grafana Enterprise, published on 30 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when creating a dashboard through the dashboard API, because these fields were stored without an authorization check. The dashboard then appears file-provisioned, and administrators can no longer update or delete it through Grafana. The impact is limited to the same organization and no data is exposed.
Which versions are affected by CVE-2026-13720?
1 open source package ship an affected version, including grafana.
| Package | Affected | Fixed in |
|---|---|---|
grafana Bitnami | From 12.0.0 | 12.4.12, 13.0.10, 13.1.7, 13.2.3 |
How do I fix CVE-2026-13720?
Upgrade grafana to a fixed version for your release line: 12.4.12, 13.0.10, 13.1.7 or 13.2.3.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-13720 being exploited?
There is no known exploitation of CVE-2026-13720 in the wild and no public exploit code.
Sources
Also known as BIT-grafana-2026-13720, GHSA-9q62-r26p-xcjv, MINI-4c62-v4jq-47f5, MINI-63qp-rgjp-mqm2, MINI-69h4-392c-2c34, MINI-7qpm-c54j-294r and 12 more.