CVE-2026-19197 Broken access control in dashboard snapshots
Organization admins can delete other orgs' snapshots and recover secret keys, allowing unauthorized data modification and disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-19197?
CVE-2026-19197 is a medium-severity missing authorization vulnerability in Grafana Enterprise, published on 26 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control).
Weakness: CWE-862
Which versions are affected by CVE-2026-19197?
1 open source package ship an affected version, including grafana.
| Package | Affected | Fixed in |
|---|---|---|
grafana Bitnami | From 12.4.0 | 12.4.8, 13.0.6, 13.1.3 |
How do I fix CVE-2026-19197?
Upgrade grafana to a fixed version for your release line: 12.4.8, 13.0.6 or 13.1.3.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-19197 being exploited?
There is no known exploitation of CVE-2026-19197 in the wild and no public exploit code.
Sources
Also known as BIT-grafana-2026-19197, GHSA-ccq3-xjc6-g2c3, MINI-9g4h-9f6h-vj6v, MINI-qf2x-5qcx-cf37, MINI-r9xf-8vw3-hfxr, MINI-v864-6g78-p5j9 and 3 more.